{
  "family": "mabezat",
  "sample_count": 36,
  "category": "worm",
  "description": "Mabezat (extensively documented in threat research and anti-malware databases as Worm:Win32/Mabezat, Virus:Win32/Mabezat.B, and W32.Mabezat) is a landmark polymorphic worm and parasitic file infector first identified in 2007. Engineered to spread aggressively across local networks, removable USB drives, and email systems, Mabezat infects Portable Executable (PE) files by appending its polymorphic malicious code to the last section of executables. In addition to executable infection, Mabezat recursively traverses local and mapped drives, searching for user documents and media files (.doc, .pdf, .xls, .jpg), encrypting them with a custom XOR/RC4 algorithm, and appending the .dlz or .chm extension. It distributes copies of itself disguised inside self-extracting RAR archives, creates autorun.inf files on removable media, and harvests email addresses from Windows Address Books to send infectious messages via direct SMTP connections.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/Mabezat",
    "Virus:Win32/Mabezat.B",
    "Virus.Win32.Mabezat.b",
    "Win32/Mabezat",
    "W32.Mabezat",
    "Worm.Win32.Mabezat"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Worm:Win32/Mabezat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mabezat is a historic polymorphic worm and virus that infects Windows executable files, encrypts personal documents, and spreads via USB drives, network shares, and email."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mabezat propagate through removable USB storage?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It copies its executable to the root of connected USB flash drives and writes a malicious autorun.inf configuration to launch automatically when inserted."
      }
    },
    {
      "@type": "Question",
      "name": "What happens to documents infected or targeted by Mabezat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mabezat encrypts user documents (.doc, .pdf, .xls) and renames them with extensions like .dlz or .chm, making them inaccessible without decryption routines."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mabezat infect other executable files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It appends polymorphic viral code to the final section of existing PE executables, redirecting the entry point to execute the virus before returning control to the host program."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be disinfected from a Mabezat infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disable Windows Autorun/Autoplay, boot into Safe Mode to clean infected PE files with specialized disinfection tools, and restore encrypted documents from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1091",
    "T1080",
    "T1566.001",
    "T1486",
    "T1057"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2007,
  "threat_actor": null,
  "delivery_mechanism": [
    "Removable USB Media (Autorun.inf)",
    "Local Area Network (SMB Shares)",
    "Infectious Email Attachments",
    "Parasitic PE File Infection"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows Vista",
    "Windows XP",
    "Windows Server 2003",
    "Windows 2000"
  ],
  "capabilities": [
    "Parasitic PE Executable Infection",
    "Document Encryption (.dlz / .chm)",
    "Removable Storage Autorun Propagation",
    "Network Share Traversal",
    "Direct SMTP Mass-Mailing"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Polymorphic Virus)",
      "Infected PE Binary"
    ],
    "network_signatures": [
      "Outbound SMTP traffic on port 25 transmitting spoofed emails containing infected executable attachments",
      "High-volume SMB/RPC scans across local subnets targeting writable administrative shares"
    ],
    "evasion_techniques": [
      "Polymorphic encryption engine altering the virus decryptor stub on every new infected host file",
      "Killing antivirus processes and terminating security monitoring services"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "290123456789abcdef0123456789abcd01234567",
      "30123456789abcdef0123456789abcd012345678"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Tazebama",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\Hidden\\SHOWALL"
    ],
    "file_paths": [
      "%SystemRoot%\\mabezat.exe",
      "%SystemRoot%\\system32\\tazebama.dll",
      "%Drive%\\autorun.inf"
    ]
  },
  "defensive_measures": [
    "Disable Windows AutoRun and AutoPlay functionality enterprise-wide via Group Policy (GPO)",
    "Deploy antivirus software with clean file restoration capabilities to disinfect appended PE headers without deleting host software",
    "Restrict write permissions on network shares to prevent worm lateral movement"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Worm:Win32/Mabezat.B",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Mabezat.B"
    },
    {
      "name": "Symantec Threat Report - W32.Mabezat Technical Profile",
      "url": "https://www.broadcom.com"
    },
    {
      "name": "Kaspersky Securelist - Virus.Win32.Mabezat.b In-Depth",
      "url": "https://securelist.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Worm:Win32/Mabezat.A",
      "Virus:Win32/Mabezat.B",
      "Virus.Win32.Mabezat.c"
    ]
  },
  "motivation": "Aggressive Worm Propagation, File Infection & Data Extortion",
  "sample_hashes": []
}