Home / malware

PDF

Virus:Win32/Mabezat.B

First posted on 09 February 2009.
Source: SecurityHome

Aliases :

Virus:Win32/Mabezat.B is also known as Also Known As:Win32/Mabezat.worm.32768 (AhnLab), W32/AutoRun.APZ (Norman), W32/Mabezat-B (Sophos), W32.Mabezat-3 (Clam AV), Win32/Mabezat.A (ESET), Worm.Win32.Mabezat.b (other), Worm.Win32.Mabezat.b (Kaspersky), Win32.Worm.Mabezat.C (Sunbelt Software), W32/Mabezat.a (McAfee).

Explanation :

Virus:Win32/Mabezat.B is a polymorphic virus that infects PE files. Apart from spreading via file infection, it also attempts to spread via network shares, removable drives and by CD-burning. It contains a date-based payload that encrypts files with particular extensions.

Symptoms
System ChangesThe following system changes may indicate the presence of Virus:Win32/Mabezat.B:

Virus:Win32/Mabezat.B is a polymorphic virus that infects PE files. Apart from spreading via file infection, it also attempts to spread via network shares, removable drives and by CD-burning. It contains a date-based payload that encrypts files with particular file extensions.

Installation
Upon execution, Virus:Win32/Mabezat.B drops the file '%Root%Documents and Settings azebama.dll'. It then loads an installation module from tazebama.dll, that drops the following copies of the virus:

%Root%Documents and Settingshook.dl_

%Root%Documents and Settings azebama.dl_

It creates a process for tazebama.dl_, and then executes the original code of the host file.Spreads Via…E-mailThe virus checks for an Internet connection by attempting to connect to the following sites: http://www.britishcouncil.com
http://www.yahoo.com
http://www.hotmail.com
http://www.microsoft.com It avoids sending mail to e-mail addresses that contain the following strings: MICROSOFT
KASPER
PANDA E-mail sent by the virus are variable. The virus may send e-mail with the following characteristics: Subject:
ABOUT PEOPLE WITH WHOM MATRIMONY IS PROHIBITEDMessage Body:1 : If a man commits adultery with a woman, then it is not permissible for him to marry her mother or her daughters.
2 : If a woman out of sexual passion and with evil intent commits sexual intercourse with a man, then it is not permissible for the mother or daughters of that woman to merry that man. In the same way, the man who committed sexual intercourse with a woman, because prohibited for her mother and daughters.
Download the attached article to read.Attachment:PROHIBITED_MATRIMONY.rar Subject:
Windows secretsMessage Body:The attached article is on
how to make a folder password
. If your are interested in this article download it, if you are not delete it.Attachment:FolderPW_CH(1).rar Subject: Canada immigrationMessage Body: The debate is no longer about whether Canada should remain open to immigration. That debate became moot when Canadians realized that low birth rates and an aging population would eventually lead to a shrinking populace. Baby bonuses and other such incentives couldn't convince Canadians to have more kids, and demographic experts have forecasted that a Canada without immigration would pretty much disintegrate as a nation by 2050.
Download the attached file to know about the required forms.
The sender of this email got this article from our side and forwarded it to you.Attachment:IMM_Forms_E01.rar Subject:
Viruses historyMessage Body: Nowadays, the viruses have become one of the most dangerous systems to attack the computers. There are a lot of kinds of viruses. The common and popular kind is called
Trojan.Backdoor
which runs as a backdoor of the victim machine. This enables the virus to have a full remote administration of the victim machine. To read the full story about the viruses history since 1970 download the attached and decompress It by WinRAR.
The sender has red the story and forwarded it to you.Attachment:virushistory.rar Subject: Web designer vacancyMessage Body: Fortunately, we have recently received your CV/Resume from moister web site
and we found it matching the job requirements we offer.
If your are interested in this job Please send us an updated CV showing the required items with the attached file that we sent.
Thanks
Regards,
Ajy Bokra
Computer department.
AjyBokra@webconsulting.comAttachment: JobDetails.rar Subject: MBA new visionMessage Body: MBA (Master of business administration ) one of the most required degree around the world. We offer a lot of books helping you to gain this degree. We attached one of our .doc word formatted books on
Marketing basics
to download.
Our web site http://ww w.tazeunv.edu.cr/mba/info.htm
Contacts:
Human resource
Ajy klaf
AjyKolav@tazeunv.com
The sender has added your name to be informed with our services.Attachment: Marketing.rar
Subject: problemoMessage Body: When I had opened your last email I received some errors have been saved in the attached file.
Please inform me with those errors as soon as possible.Attachment: utlooklog.rar Subject:
hiMessage Body:notes.rar
Unfortunately, I received unformatted email with an attached file from you. I couldn't understand what is behind the words.
I wish you next time send me a readable file!.I forwarded the attached file again to evaluate your self.Attachment:doc2.rar It attempts to use the archiving application Winrar to archive itself when creating attachments. It looks for Winrar by querying the following registry entry: HKLMsoftwaremicrosoftwindowsCurrentVersionApp PathsWinRAR.exe To use Winrar it initially creates a folder containing a copy of the virus. For example, to create MyDocuments.rar it copies itself to the following folder: %Root%:Documents and SettingsMyDocumentsReadme.doc .exe It then archives this folder, to create MyDocuments.rar. Aside from the predefined attachments described above, it may use one of the following as a filename for its attachment: GoogleToolbarNotifier.exe
PanasonicDVD_DigitalCam.exe
Antenna2Net.exe
RadioTV.exe
Microsoft MSN.exe
Sony Erikson DigitalCam.exe
IDE Conector P2P.exe
Windows Keys Secrets.exe
FaxSend.exe
RecycleBinProtect.exe
Disk Defragmenter.exe
CD Burner.exe
ShowDesktop.exe
BrowseAllUsers.exe
LockWindowsPartition.exe
Win98compatibleXP.exe
MakeUrOwnFamilyTree.exe
WindowsXp StartMenu Settings.exe
Recycle Bin.exe
Adjust Time.exe
Microsoft Windows Network.exe
HP_LaserJetAllInOneConfig.exe
FloppyDiskPartion.exe
msjavx86.exe
AmericanOnLine.exe
Crack_GoogleEarthPro.exe
Lock Folder.exe
InstallMSN11En.exe
InstallMSN11Ar.exe
JetAudio dump.exe
KasperSky6.0 Key.doc.exe
Office2007 Serial.txt.exe
Office2003 CD-Key.doc.exe
Make Windows Original.exe
NokiaN73Tools.exe
WinrRarSerialInstall.exe
My Documents .exe
Readme.doc .exe
My documents .exe Archived files may use one of the following filenames: windows.rar
office_crack.rar
serials.rar
passwords.rar
windows_secrets.rar
source.rar
imp_data.rar
documents_backup.rar
backup.rar
MyDocuments.rar
File InfectionVirus:Win32/Mabezat.B is a polymorphic virus that infects PE files with the following extensions: .lnk
.exe
.scr It searches for files to infect by enumerating the following registry entries: HKLMsoftwaremicrosoftwindowsCurrentVersionApp Paths
HKLMsoftwareMicrosoftWindowsCurrentVersion
un It also searches for files to infect in the following folders:

%Root%:Documents and Settings\%username%Local SettingsApplication DataMicrosoftCD Burning

<machine name>c$Documents and Settings

<machine name>Start MenuProgramsStartup

Network SharesThis virus tries to copy itself to the following locations:

<machine name>c$Documents and Settings

<machine name>Start MenuProgramsStartup

using the following usernames: Administrator
Anonymous and constructing passwords by combining the following characters, including spaces: abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
0123456789 For example:
123
1111
11111111
2222
22222222
3333
33333333
123456789
abcd
abcdefghi Removable DrivesIt also attempts to spread to all removable drives from Z: to C: by dropping copies of the following files:

zPharaoh.exe

autorun.inf

Autorun.inf is created initially as 1.taz and contains the following code: [AutoRun]
ShellExecute=zPharaoh.exe
shellopencommand=zPharaoh.exe
shellexplorecommand=zPharaoh.exe
open=zPharaoh.exe This enables automatic execution upon opening the infected drive. 1.taz is then renamed to autorun.inf. CD-BurningVirus:Win32/Mabezat.B drops the following files so that it can spread via CD when CD burning is initiated:

%Root%:Documents and Settings\%username%Local SettingsApplication DataMicrosoftCD BurningzPharaoh.exe

%Root%:Documents and Settings\%username%Local SettingsApplication DataMicrosoftCD Burning1.taz

It then renames 1.taz to:

%Root%:Documents and Settings\%username%Local SettingsApplication DataMicrosoftCD Burningautorun.inf

Every time the infected CD is inserted into a system that allows auto play of CDs, the malware will execute.

Payload
Encrypts DataIf the following conditions hold the virus encrypts certain files:

If the year is greater than or equal to 2012;

If the month is equal to or greater than 10;

and the day is equal to or greater than 16.

Files with the following extensions are encrypted:
.hlp
.pdf
.html
.txt
.aspx
.cs
.aspx
.psd
.mdf
.rtf
.htm
.ppt
.php
.asp
.pas
.h
.cpp
.xls
.doc
.rar
.zip
.mdb Virus:Win32/Mabezat.B also appends the string TAZEBAMA at the end of the encrypted file.
Additional InformationVirus:Win32/Mabezat.B sets the following registry entry to hide extension and files.Adds value with data: Hidden = 1
Adds value with data: ShowSuperHidden = 0
Adds value with data: HideFileExt = 1
To subkey: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced The virus logs its activities the following file:

%Root%:Documents and Settings\%user%Application Data azebamazPharaoh.dat

This file contains the following string as a header: tazebama trojan log file Virus:Win32/Mabezat.B deletes the following registry entry to avoid easy modification of auto run settings: HKLMSoftwareMicrosoftWindowsCurrentVersionpoliciesexplorer
NoDriveTypeAutoRun

Last update 09 February 2009

 

TOP