{
  "family": "tenga",
  "sample_count": 50,
  "category": "trojan",
  "description": "Virus:Win32/Tenga is a highly destructive, network-aware file infector and worm that aggressively appends malicious code to legitimate executable files (`.exe`) across both local drives and mapped network shares, causing widespread system corruption.<br><br><b>Understanding the Tenga Virus</b><br>To the end-user, a Tenga infection manifests as severe system instability. Legitimate applications crash or fail to open, and the system may become unresponsive. For incident responders, Tenga is a nightmare scenario. Unlike modern trojans that simply drop a malicious payload into `%AppData%`, Tenga is a true virus; it physically modifies and corrupts thousands of legitimate, benign files (`T1027.001`). If Tenga gains access to a corporate file share, it will systematically infect every executable it can write to, rapidly crippling the network.<br><br><b>Execution and Evasion Strategies</b><br>Tenga typically enters an environment via a single infected executable downloaded by a user or dropped by another threat. Upon execution, the virus searches the local hard drive for `.exe` files. It modifies the entry point of the target executable and appends its malicious code to the end of the file. Crucially, Tenga also actively scans the local subnet for exposed SMB shares (TCP 445). It attempts to authenticate using null sessions or weak credentials. If successful, it recursively infects every executable on the remote share. The virus also possesses downloading capabilities, often pulling down secondary payloads from hardcoded IP addresses.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive file corruption and widespread system failure. EDR platforms will flag a single process rapidly reading and modifying hundreds of executable files across the system (`T1485`). Network logs will show aggressive outbound SMB scanning on port 445 originating from the infected host. Security analysts will notice that the file sizes of standard Windows utilities (like `notepad.exe` or `calc.exe`) have increased.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1091",
    "T1027.001",
    "T1021.002",
    "T1105",
    "T1485"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1027.001",
      "name": "Obfuscated Files or Information: Indicator Removal from Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoint from the network to halt the rapid SMB propagation and prevent the corruption of central file shares.",
    "Enforce strict network segmentation, immediately blocking lateral SMB (TCP 445) traffic between workstation subnets.",
    "Do NOT attempt to simply delete the infected files; because Tenga infects legitimate system binaries, deleting them will destroy the OS.",
    "Deploy specialized antivirus 'disinfection' routines (if available) to strip the appended virus code, otherwise, a complete OS rebuild is mandatory."
  ],
  "what_to_avoid": [
    "Do not execute any files from a network share while Tenga is active; you will instantly execute the virus on your local machine.",
    "Avoid assuming standard file deletion works; the virus code is physically merged into the legitimate applications."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}