Home / malware
First posted on 06 May 2016.
There are no other names known for Virus:Win32/Mabezat.B.
Virus:Win32/Mabezat.B is a polymorphic virus that infects Windows executable files. Apart from spreading via file infection, it also attempts to spread via e-mail attachments, network shares, removable drives and by CD-burning. It contains a date-based payload that encrypts files with particular file extensions.
Upon execution, Virus:Win32/Mabezat.B drops the file '%Root%\Documents and Settings\tazebama.dll'. It then loads an installation module from tazebama.dll, that drops the following copies of the virus:
It creates a process for tazebama.dl_, and then executes the original code of the host file.
- %SystemDrive%\Documents and Settings\hook.dl_
- %SystemDrive%\Documents and Settings\tazebama.dl_
The virus checks for an Internet connection by attempting to connect to the following sites: http://www.britishcouncil.com
http://www.microsoft.com It avoids sending mail to e-mail addresses that contain the following strings: MICROSOFT
PANDA E-mail sent by the virus are variable. The virus may send e-mail with the following characteristics: Subject:
ABOUT PEOPLE WITH WHOM MATRIMONY IS PROHIBITEDMessage Body: 1 : If a man commits adultery with a woman, then it is not permissible for him to marry her mother or her daughters.
2 : If a woman out of sexual passion and with evil intent commits sexual intercourse with a man, then it is not permissible for the mother or daughters of that woman to merry that man. In the same way, the man who committed sexual intercourse with a woman, because prohibited for her mother and daughters.
Download the attached article to read.Attachment: PROHIBITED_MATRIMONY.rar Subject:
Windows secretsMessage Body: The attached article is on
how to make a folder password
. If your are interested in this article download it, if you are not delete it.Attachment: FolderPW_CH(1).rar Subject: Canada immigration
The debate is no longer about whether Canada should remain open to immigration. That debate became moot when Canadians realized that low birth rates and an aging population would eventually lead to a shrinking populace. Baby bonuses and other such incentives couldn't convince Canadians to have more kids, and demographic experts have forecasted that a Canada without immigration would pretty much disintegrate as a nation by 2050.
Download the attached file to know about the required forms.
The sender of this email got this article from our side and forwarded it to you.Attachment: IMM_Forms_E01.rar Subject:
Nowadays, the viruses have become one of the most dangerous systems to attack the computers. There are a lot of kinds of viruses. The common and popular kind is called
which runs as a backdoor of the victim machine. This enables the virus to have a full remote administration of the victim machine. To read the full story about the viruses history since 1970 download the attached and decompress It by WinRAR.
The sender has red the story and forwarded it to you.Attachment: virushistory.rar Subject: Web designer vacancy
Fortunately, we have recently received your CV/Resume from moister web site
and we found it matching the job requirements we offer.
If your are interested in this job Please send us an updated CV showing the required items with the attached file that we sent.
JobDetails.rar Subject: MBA new visionMessage Body: MBA (Master of business administration ) one of the most required degree around the world. We offer a lot of books helping you to gain this degree. We attached one of our .doc word formatted books on
Our web site http://ww w.tazeunv.edu.cr/mba/info.htm
The sender has added your name to be informed with our services.Attachment: Marketing.rarSubject: problemo
When I had opened your last email I received some errors have been saved in the attached file.
Please inform me with those errors as soon as possible.Attachment: utlooklog.rar Subject:
hiMessage Body: notes.rar
Unfortunately, I received unformatted email with an attached file from you. I couldn't understand what is behind the words.
I wish you next time send me a readable file!.I forwarded the attached file again to evaluate your self.Attachment: doc2.rar It attempts to use the archiving application Winrar to archive itself when creating attachments. It looks for Winrar by querying the following registry entry: HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\WinRAR.exe To use Winrar it initially creates a folder containing a copy of the virus. For example, to create MyDocuments.rar it copies itself to the following folder:
%SystemRoot%\Documents and Settings\MyDocuments\Readme.doc .exeIt then archives this folder, to create 'MyDocuments.rar'. Aside from the predefined attachments described above, it may use one of the following as a filename for its attachment: GoogleToolbarNotifier.exe
Sony Erikson DigitalCam.exe
IDE Conector P2P.exe
Windows Keys Secrets.exe
WindowsXp StartMenu Settings.exe
Microsoft Windows Network.exe
Make Windows Original.exe
My Documents .exe
My documents .exe Archived files may use one of the following filenames: windows.rar
MyDocuments.rar File infection
Virus:Win32/Mabezat.B is a polymorphic virus that infects Windows executable files with the following file extensions: .lnk
.scr It searches for files to infect by enumerating the following registry entries: HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths
HKLM\Software\Microsoft\Windows\CurrentVersion\Run It also searches for files to infect in the following folders:
- %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\
\c$\Documents and Settings\
This virus tries to copy itself to the following locations:
using the following usernames: Administrator
\c$\Documents and Settings\
Anonymous and constructing passwords by combining the following characters, including spaces: abcdefghijklmnopqrstuvwxyz
0123456789 For example: 123
abcdefghi Removable drives
Mabezat attempts to spread to all removable drives from Z: to C: by copying itself as 'zPharaoh.exe'. It then writes an autorun configuration file named 'autorun.inf' pointing to 'zPharaoh.exe'. When the removable or networked drive is accessed from another machine supporting the Autorun feature, the malware is launched automatically.Autorun.inf is created initially as '1.taz' before being renamed to 'autorun.inf'. CD-Burning
Virus:Win32/Mabezat.B drops the following files so that it can spread via CD when CD burning is initiated:
It then renames 1.taz to:
- %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\zPharaoh.exe
- %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\1.taz
Every time the infected CD is inserted into a system that allows auto play of CDs, the malware will execute.
- %Root%:\Documents and Settings\%username%\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf
If the following conditions hold the virus encrypts certain files:
Files with the following extensions are encrypted:
- If the year is greater than or equal to 2012;
- If the month is equal to or greater than 10;
- and the day is equal to or greater than 16.
.mdb Virus:Win32/Mabezat.B also appends the string TAZEBAMA at the end of the encrypted file.
Virus:Win32/Mabezat.B sets the following registry entry to hide extension and files. Adds value with data: Hidden = 1
Adds value with data: ShowSuperHidden = 0
Adds value with data: HideFileExt = 1
To subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced The virus logs its activities to the file '%USERPROFILE%\Application Data\tazebama\zPharaoh.dat'. This file contains the following string as a header: tazebama trojan log file Virus:Win32/Mabezat.B deletes the following registry entry to avoid easy modification of autorun settings: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Analysis by Francis Allan Tan Seng
Last update 06 May 2016