{
  "family": "mabezat",
  "sample_count": 36,
  "category": "trojan",
  "description": "Virus:Win32/Mabezat is a highly destructive, polymorphic file infector and network worm that aggressively appends malicious code to legitimate executable files (`.exe`) across local drives, removable media, and mapped network shares, while simultaneously acting as a mass-mailing worm to propagate via email.<br><br><b>Understanding Mabezat</b><br>To the end-user, a Mabezat infection manifests as severe system instability. Legitimate applications crash, and the system may become unresponsive. Furthermore, the user's contacts begin receiving spam emails originating from the infected machine. For incident responders, Mabezat is a chaotic, multi-vector threat. Unlike modern trojans that simply drop a payload, Mabezat physically modifies and corrupts thousands of legitimate, benign files (`T1027.001`). If Mabezat gains access to a corporate file share, it will systematically infect every executable it can write to, rapidly crippling the network.<br><br><b>Execution and Evasion Strategies</b><br>Mabezat is introduced via infected executables, USB drives, or malicious email attachments. Upon execution, the virus decrypts its payload in memory. It searches the local hard drive for `.exe` files, modifies the entry point, and appends its polymorphic code to the file. It also creates hidden, malicious autorun files (`autorun.inf`) on all connected USB drives and network shares (`T1091`). Concurrently, Mabezat harvests email addresses from the local machine (e.g., from Outlook address books or cached web files) (`T1114.001`) and utilizes a built-in SMTP engine to email copies of itself to those contacts (`T1566.001`), utilizing deceptive subject lines.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive file corruption, widespread system failure, and severe reputational damage due to the outbound spam. EDR platforms will flag a single process rapidly reading and modifying hundreds of executable files (`T1485`). Network logs will show massive spikes in outbound SMTP (TCP 25) traffic. Security analysts will notice the proliferation of hidden `autorun.inf` files across file shares and USB drives, alongside altered file sizes for standard Windows utilities.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027.001",
    "T1091",
    "T1566.001",
    "T1485",
    "T1114.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1027.001",
      "name": "Obfuscated Files or Information: Indicator Removal from Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoint from the network to halt the rapid file share propagation and prevent the massive outbound spam campaigns.",
    "Enforce strict network segmentation, immediately blocking outbound SMTP (TCP 25) traffic from standard user workstations.",
    "Do NOT attempt to simply delete the infected files; because Mabezat infects legitimate system binaries, deleting them will destroy the OS.",
    "Deploy specialized antivirus 'disinfection' routines to strip the appended virus code; if unavailable, a complete OS rebuild is mandatory."
  ],
  "what_to_avoid": [
    "Do not execute any files from a network share or plug in USB drives while Mabezat is active; you will instantly spread the virus.",
    "Avoid assuming standard file deletion works; the virus code is physically merged into the legitimate applications."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}