Malware Alert: Win32.Worm.Mabezat.J is Hiring!

The spam message comes with a variety of job-related email subjects, such as Web designer vacancy,
New work for you, Welcome to your new work, or We are hiring you. It also contains an apparently harmless attachment called winmail.dat (a file that is supposed to contain the Exchange Server® RTF information for the message, if the recipient's client cannot receive messages in Rich Text Format (RTF).

However, the winmail.dat file can be extracted with either WinRar® or WinZip^TM. This approach ensures that the user still can extract the infected file, but prevents antimalware filters on mail servers from unpacking and analyzing the contents of the archive. If extracted, the archive presents what appears to be a Word document called Readme.doc, but - at a closer look - proves to be an executable file infected with Win32.Worm.Mabezat.J.

Once opened, the alleged Readme file would open its own directory (the path where the worm is located) using Windows® Explorer. The worm would also write an autorun.inf file on each drive pointing to a newly-created file called zPharaoh.exe (an instance of itself).

What is particularly important about Win32.Worm.Mabezat.J is the fact that it is also able to infect executable files by replacing the first 1768 bytes of the infected executable file with its own encrypted body. The worm always starts its infection campaign by compromising the Windows Media Player main executable, as well as some binary files in Outlook® Express^TM.

The Mabezat family is extremely dangerous: its members not only that have the ability to infect binary files and to occasionally destroy system files, but they can also collect email addresses from a variety of file formats (such as .XML, .PHP, .LOG, .CHM, .HLP, .CPP, .PAS, .XLS, .PPT, .PDF, .ASPX, .ASP, .HTML, .HTM, .RTF and .TXT) it may find on the infected system. After it has compiled a e-mail list, the worm would start mass-mailing itself by using its own SMTP engine.

In order to stay safe, BitDefender® recommends that you download, install and update a complete antimalware suite with antivirus, antispam, antiphishing and firewall protection and to manifest extra caution when prompted to open files from unfamiliar locations.