Home / malware

PDF

Virus:Win32/Mabezat.B

First posted on 06 May 2016.
Source: Microsoft

Aliases :

There are no other names known for Virus:Win32/Mabezat.B.

Explanation :

Virus:Win32/Mabezat.B is a polymorphic virus that infects Windows executable files. Apart from spreading via file infection, it also attempts to spread via e-mail attachments, network shares, removable drives and by CD-burning. It contains a date-based payload that encrypts files with particular file extensions.

Installation

Upon execution, Virus:Win32/Mabezat.B drops the file '%Root%\Documents and Settings\tazebama.dll'. It then loads an installation module from tazebama.dll, that drops the following copies of the virus:

• %SystemDrive%\Documents and Settings\hook.dl_
• %SystemDrive%\Documents and Settings\tazebama.dl_

It creates a process for tazebama.dl_, and then executes the original code of the host file.

Spreads through…

Email
The virus checks for an Internet connection by attempting to connect to the following sites: http://www.britishcouncil.com
http://www.yahoo.com
http://www.hotmail.com
http://www.microsoft.com It avoids sending mail to e-mail addresses that contain the following strings: MICROSOFT
KASPER
PANDA E-mail sent by the virus are variable. The virus may send e-mail with the following characteristics: Subject:
ABOUT PEOPLE WITH WHOM MATRIMONY IS PROHIBITEDMessage Body: 1 : If a man commits adultery with a woman, then it is not permissible for him to marry her mother or her daughters.
2 : If a woman out of sexual passion and with evil intent commits sexual intercourse with a man, then it is not permissible for the mother or daughters of that woman to merry that man. In the same way, the man who committed sexual intercourse with a woman, because prohibited for her mother and daughters.
Download the attached article to read.Attachment: PROHIBITED_MATRIMONY.rar Subject:
Windows secretsMessage Body: The attached article is on
how to make a folder password
. If your are interested in this article download it, if you are not delete it.Attachment: FolderPW_CH(1).rar Subject: Canada immigration

Message Body:

The debate is no longer about whether Canada should remain open to immigration. That debate became moot when Canadians realized that low birth rates and an aging population would eventually lead to a shrinking populace. Baby bonuses and other such incentives couldn't convince Canadians to have more kids, and demographic experts have forecasted that a Canada without immigration would pretty much disintegrate as a nation by 2050.
Download the attached file to know about the required forms.
The sender of this email got this article from our side and forwarded it to you.Attachment: IMM_Forms_E01.rar Subject:
Viruses history

Message Body:

Nowadays, the viruses have become one of the most dangerous systems to attack the computers. There are a lot of kinds of viruses. The common and popular kind is called
Trojan.Backdoor
which runs as a backdoor of the victim machine. This enables the virus to have a full remote administration of the victim machine. To read the full story about the viruses history since 1970 download the attached and decompress It by WinRAR.
The sender has red the story and forwarded it to you.Attachment: virushistory.rar Subject: Web designer vacancy

Message Body:

Fortunately, we have recently received your CV/Resume from moister web site
and we found it matching the job requirements we offer.
If your are interested in this job Please send us an updated CV showing the required items with the attached file that we sent.
Thanks
Regards,
Ajy Bokra
Computer department.
AjyBokra@webconsulting.com

Attachment:

JobDetails.rar Subject: MBA new visionMessage Body: MBA (Master of business administration ) one of the most required degree around the world. We offer a lot of books helping you to gain this degree. We attached one of our .doc word formatted books on
Marketing basics
to download.
Our web site http://ww w.tazeunv.edu.cr/mba/info.htm
Contacts:
Human resource
Ajy klaf
AjyKolav@tazeunv.com
The sender has added your name to be informed with our services.Attachment: Marketing.rarSubject: problemo

Message Body:

When I had opened your last email I received some errors have been saved in the attached file.
Please inform me with those errors as soon as possible.Attachment: utlooklog.rar Subject:
hiMessage Body: notes.rar
Unfortunately, I received unformatted email with an attached file from you. I couldn't understand what is behind the words.
I wish you next time send me a readable file!.I forwarded the attached file again to evaluate your self.Attachment: doc2.rar It attempts to use the archiving application Winrar to archive itself when creating attachments. It looks for Winrar by querying the following registry entry: HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\WinRAR.exe To use Winrar it initially creates a folder containing a copy of the virus. For example, to create MyDocuments.rar it copies itself to the following folder:

%SystemRoot%\Documents and Settings\MyDocuments\Readme.doc .exe

It then archives this folder, to create 'MyDocuments.rar'. Aside from the predefined attachments described above, it may use one of the following as a filename for its attachment: GoogleToolbarNotifier.exe
PanasonicDVD_DigitalCam.exe
Antenna2Net.exe
RadioTV.exe
Microsoft MSN.exe
Sony Erikson DigitalCam.exe
IDE Conector P2P.exe
Windows Keys Secrets.exe
FaxSend.exe
RecycleBinProtect.exe
Disk Defragmenter.exe
CD Burner.exe
ShowDesktop.exe
BrowseAllUsers.exe
LockWindowsPartition.exe
Win98compatibleXP.exe
MakeUrOwnFamilyTree.exe
WindowsXp StartMenu Settings.exe
Recycle Bin.exe
Adjust Time.exe
Microsoft Windows Network.exe
HP_LaserJetAllInOneConfig.exe
FloppyDiskPartion.exe
msjavx86.exe
AmericanOnLine.exe
Crack_GoogleEarthPro.exe
Lock Folder.exe
InstallMSN11En.exe
InstallMSN11Ar.exe
JetAudio dump.exe
KasperSky6.0 Key.doc.exe
Office2007 Serial.txt.exe
Office2003 CD-Key.doc.exe
Make Windows Original.exe
NokiaN73Tools.exe
WinrRarSerialInstall.exe
My Documents .exe
Readme.doc .exe
My documents .exe Archived files may use one of the following filenames: windows.rar
office_crack.rar
serials.rar
passwords.rar
windows_secrets.rar
source.rar
imp_data.rar
documents_backup.rar
backup.rar
MyDocuments.rar File infection
Virus:Win32/Mabezat.B is a polymorphic virus that infects Windows executable files with the following file extensions: .lnk
.exe
.scr It searches for files to infect by enumerating the following registry entries: HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths
HKLM\Software\Microsoft\Windows\CurrentVersion\Run It also searches for files to infect in the following folders:

• %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\
• \\\c$\Documents and Settings\
• \\\Start Menu\Programs\Startup\

Network shares
This virus tries to copy itself to the following locations:

• \\\c$\Documents and Settings\
• \\\Start Menu\Programs\Startup\

using the following usernames: Administrator
Anonymous and constructing passwords by combining the following characters, including spaces: abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
0123456789 For example: 123
1111
11111111
2222
22222222
3333
33333333
123456789
abcd
abcdefghi Removable drives
Mabezat attempts to spread to all removable drives from Z: to C: by copying itself as 'zPharaoh.exe'. It then writes an autorun configuration file named 'autorun.inf' pointing to 'zPharaoh.exe'. When the removable or networked drive is accessed from another machine supporting the Autorun feature, the malware is launched automatically.Autorun.inf is created initially as '1.taz' before being renamed to 'autorun.inf'. CD-Burning
Virus:Win32/Mabezat.B drops the following files so that it can spread via CD when CD burning is initiated:

• %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\zPharaoh.exe
• %USERPROFILE%\Local Settings\Application Data\Microsoft\CD Burning\1.taz

It then renames 1.taz to:

• %Root%:\Documents and Settings\%username%\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf

Every time the infected CD is inserted into a system that allows auto play of CDs, the malware will execute.

Payload

Encrypts data
If the following conditions hold the virus encrypts certain files:

• If the year is greater than or equal to 2012;
• If the month is equal to or greater than 10;
• and the day is equal to or greater than 16.

Files with the following extensions are encrypted:
.hlp
.pdf
.html
.txt
.aspx
.cs
.aspx
.psd
.mdf
.rtf
.htm
.ppt
.php
.asp
.pas
.h
.cpp
.xls
.doc
.rar
.zip
.mdb Virus:Win32/Mabezat.B also appends the string TAZEBAMA at the end of the encrypted file.

Additional Information

Virus:Win32/Mabezat.B sets the following registry entry to hide extension and files. Adds value with data: Hidden = 1
Adds value with data: ShowSuperHidden = 0
Adds value with data: HideFileExt = 1
To subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced The virus logs its activities to the file '%USERPROFILE%\Application Data\tazebama\zPharaoh.dat'. This file contains the following string as a header: tazebama trojan log file Virus:Win32/Mabezat.B deletes the following registry entry to avoid easy modification of autorun settings: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun

Analysis by Francis Allan Tan Seng

Last update 06 May 2016

 

TOP