Home / malware

PDF

Worm:W32/Mabezat.B

First posted on 26 May 2009.
Source: SecurityHome

Aliases :

Worm:W32/Mabezat.B is also known as W32/Mabezat-B (Sophos), W32.Mabezat.B (Symantec), PE_MABEZAT.B-O (Trend Micro), Virus:Win32/Mabezat.B (Microsoft), W32/Mabezat (McAfee).

Explanation :

A standalone malicious program which uses computer or network resources to make complete copies of itself. May include code or other malware to damage both the system and the network.

Additional DetailsWorm:W32/Mabezat.B spreads through infected e-mail attachments, removable drives and network shares.

The worm includes functionality to behave as a polymorphic file infecting virus, as it is able to infect executable files.

Installation

On execution, the worm drops the following files into the system root drives:


• %root%autorun.inf
• %root%zPharaoh.exe

The autorun.inf file contains the following code:


• [AutoRun]
ShellExecute=zPharaoh.exe
shellopencommand=zPharaoh.exe
shellexplorecommand=zPharaoh.exe
open=zPharaoh.exe
The above process is used to automatically execute zPharaoh.exe, which contains the worm's executable code. It also makes the malware capable of propagating via removable drives.

The virus also creates the following folder:


• C:Documents and Settings\%currently logged-in user%Application Data azebama
And may drop the file zPharaoh.dat into it.

Infection

Mazebat.B infects files in a polymorphic manner by appending data to a section of clean file code, then relocating the entire section together with the appended data. This action means that the altered code differs in every infected file.

The virus also adds garbage code to the file to 'pad' it and increase its polymorphism.

Registry

The worm modifies the Registry to disable certain functions.

It deletes this registry entry so that Autoplay is turned off:


• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
NoDriveTypeAutoRun = 00000091
It also creates this entry:


• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
ShowSuperHidden = 00000000

Last update 26 May 2009

 

TOP