Tenga

Overview

Virus:Win32/Tenga is a highly destructive, network-aware file infector and worm that aggressively appends malicious code to legitimate executable files (`.exe`) across both local drives and mapped network shares, causing widespread system corruption.

Understanding the Tenga Virus
To the end-user, a Tenga infection manifests as severe system instability. Legitimate applications crash or fail to open, and the system may become unresponsive. For incident responders, Tenga is a nightmare scenario. Unlike modern trojans that simply drop a malicious payload into `%AppData%`, Tenga is a true virus; it physically modifies and corrupts thousands of legitimate, benign files (`T1027.001`). If Tenga gains access to a corporate file share, it will systematically infect every executable it can write to, rapidly crippling the network.

Execution and Evasion Strategies
Tenga typically enters an environment via a single infected executable downloaded by a user or dropped by another threat. Upon execution, the virus searches the local hard drive for `.exe` files. It modifies the entry point of the target executable and appends its malicious code to the end of the file. Crucially, Tenga also actively scans the local subnet for exposed SMB shares (TCP 445). It attempts to authenticate using null sessions or weak credentials. If successful, it recursively infects every executable on the remote share. The virus also possesses downloading capabilities, often pulling down secondary payloads from hardcoded IP addresses.

Indicators of Compromise & Impact
The impact is massive file corruption and widespread system failure. EDR platforms will flag a single process rapidly reading and modifying hundreds of executable files across the system (`T1485`). Network logs will show aggressive outbound SMB scanning on port 445 originating from the infected host. Security analysts will notice that the file sizes of standard Windows utilities (like `notepad.exe` or `calc.exe`) have increased.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_TENGA {
    meta:
        description = "Detects Tenga (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "tenga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Tenga Activity
id: 044580a6d3ead0f3ba4f68caec711e40
status: experimental
description: Detects generic indicators of the tenga malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*tenga*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly sever the infected endpoint from the network to halt the rapid SMB propagation and prevent the corruption of central file shares.
2. Enforce strict network segmentation, immediately blocking lateral SMB (TCP 445) traffic between workstation subnets.
3. Do NOT attempt to simply delete the infected files; because Tenga infects legitimate system binaries, deleting them will destroy the OS.
4. Deploy specialized antivirus 'disinfection' routines (if available) to strip the appended virus code, otherwise, a complete OS rebuild is mandatory.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not execute any files from a network share while Tenga is active; you will instantly execute the virus on your local machine.
2. Avoid assuming standard file deletion works; the virus code is physically merged into the legitimate applications.

References & External Analysis

• Search "tenga" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Socstealer
• Messengerpass
• Smshoax
• Regger
• Filerepmalware

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/tenga.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.