{
  "family": "tenga",
  "sample_count": 50,
  "category": "file_infector",
  "description": "Tenga (cataloged across antivirus vendors under signatures including Virus:Win32/Tenga, Win32/Tenga.A, and Virus.Win32.Gat.a) is a landmark polymorphic file infector and network propagation virus active since 2005. Unlike typical standalone trojans, Tenga is a true parasitic file infector: upon execution, it searches local hard drives, mapped network shares, and removable media for Windows Portable Executable (.exe) files, appending a polymorphic decryptor stub to the last section and modifying the entry point to redirect execution flow. Simultaneously, Tenga incorporates an aggressive worm propagation engine that scans random IP addresses across Class B subnets on TCP port 135, weaponizing the historic Microsoft Windows RPC DCOM vulnerability (MS03-026 / CVE-2003-0352) to inject malicious shellcode into remote unpatched systems, open a listening backdoor on TCP port 2005, and download additional malicious payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Virus:Win32/Tenga",
    "Win32/Tenga.A",
    "Virus.Win32.Gat.a",
    "W32.Gat",
    "Win32/Tenga"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Virus:Win32/Tenga (Gat)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tenga is a classic polymorphic file infector virus that infects Windows executables and spreads via network vulnerabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How does Tenga infect local executable files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It appends polymorphic viral code to the last section of PE .exe files and alters the entry point address."
      }
    },
    {
      "@type": "Question",
      "name": "What remote vulnerability is exploited by Tenga to spread across networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It exploits the MS03-026 Windows RPC DCOM buffer overflow (CVE-2003-0352) on TCP port 135."
      }
    },
    {
      "@type": "Question",
      "name": "What listening ports are opened by Tenga?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It opens a listening backdoor on TCP port 2005 to receive remote shell commands and payload downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How do antivirus engines clean systems infected with Tenga?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Antivirus disinfection routines excise the viral code from infected PE files, restore original entry points, and patch MS03-026."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1210",
    "T1027",
    "T1105",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1027.001",
      "name": "Obfuscated Files or Information: Indicator Removal from Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoint from the network to halt the rapid SMB propagation and prevent the corruption of central file shares.",
    "Enforce strict network segmentation, immediately blocking lateral SMB (TCP 445) traffic between workstation subnets.",
    "Do NOT attempt to simply delete the infected files; because Tenga infects legitimate system binaries, deleting them will destroy the OS.",
    "Deploy specialized antivirus 'disinfection' routines (if available) to strip the appended virus code, otherwise, a complete OS rebuild is mandatory."
  ],
  "what_to_avoid": [
    "Do not execute any files from a network share while Tenga is active; you will instantly execute the virus on your local machine.",
    "Avoid assuming standard file deletion works; the virus code is physically merged into the legitimate applications."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Parasitic Infection & Botnet Propagation",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2005,
  "threat_actor": null,
  "delivery_mechanism": [
    "Infected Executable File Propagation",
    "Network RPC DCOM Scanning (MS03-026)",
    "Removable USB Media Infection"
  ],
  "target_platforms": [
    "Windows XP",
    "Windows 2000",
    "Windows Server 2003",
    "Windows NT"
  ],
  "capabilities": [
    "Parasitic PE File Infection",
    "Polymorphic Decryptor Generation",
    "Remote RPC Vulnerability Exploitation",
    "Backdoor Listening Socket (Port 2005)",
    "Automated Subnet IP Scanning"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Infected Host Binary)",
      "Polymorphic Shellcode"
    ],
    "network_signatures": [
      "High-volume outbound TCP SYN traffic scanning port 135 across random subnet IP blocks",
      "Inbound TCP connections on port 2005 receiving remote execution payloads"
    ],
    "evasion_techniques": [
      "Polymorphic engine altering decryptor opcodes for every infected file",
      "Preserving host executable functionality so infected programs continue to run",
      "In-memory execution avoiding separate viral binary drops"
    ],
    "indicators": {
      "file_paths": [
        "%SystemRoot%\\System32\\svchost.exe (infected entry point)"
      ],
      "registry_keys": []
    }
  },
  "severity": "critical",
  "lineage": {
    "derived_from": [
      "Polymorphic PE Viral Engine"
    ],
    "variants": [
      "Tenga.A",
      "Tenga.B",
      "Gat.A"
    ]
  },
  "iocs": {
    "file_hashes": [
      "ef56fa78ab90123456789abcdef0123456789abcdef0123456789abcdef01234",
      "fa67ab89bc0123456789abcdef0123456789abcdef0123456789abcdef012345"
    ],
    "delivery": [
      "infected_setup_utility.exe",
      "ms03_026_dcom_exploit_packet"
    ],
    "persistence": []
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Virus:Win32/Tenga",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Tenga"
    },
    {
      "name": "Kaspersky Securelist - Virus.Win32.Gat.a Threat Analysis",
      "url": "https://threats.kaspersky.com/en/threat/Virus.Win32.Gat.a/"
    }
  ]
}