BScope.Worm.Mabezat (file analysis)

The BScope.Worm.Mabezat is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What BScope.Worm.Mabezat virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Authenticode signature is invalid
Anomalous binary characteristics

How to determine BScope.Worm.Mabezat?


File Info:
name: 51C54F6C0418C13543B1.mlw
path: /opt/CAPEv2/storage/binaries/38e86746a3a1da9455bd6c0fe68e9d68a24846c8f5980ee555cd85c5dd3a28b6
crc32: 7AC48FF6
md5: 51c54f6c0418c13543b1c224203c9383
sha1: 05bee0bff990fc604babe9f545091083de319335
sha256: 38e86746a3a1da9455bd6c0fe68e9d68a24846c8f5980ee555cd85c5dd3a28b6
sha512: 8a1195521d7724c3ecacc52ca75648f90d660fc9c3f326429cf213fef8f0482f2e26f0de76b5fee8be878b050bb3dffb426a05c313627e1fd2c46aa654bb941f
ssdeep: 98304:xfmE8TGowXqNIqlzYRo4cNFuxLtkBSNQdw2A17nfJxe4qPJTtk72z4iqh5hR7aRh:xmT7Nli6krgRUcH3Qx2U9AyDyT
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1028659237FC5C8BAC6730332CDBCE3B891BAF970A835451B7654632E1F70A415A19E66
sha3_384: f4e3e9c4ac48995d438b252317edf19c851fc7e882cf37dc0722496216fb890ab2278f1b777f8bd3fe9e33214bbe4a19
ep_bytes: e849f4ffffe986faffff6a1468f0cd94
timestamp: 2012-09-29 17:46:05

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft SkyDrive Pro
FileVersion: 15.0.4420.1017
InternalName: Groove
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename: Groove.exe
ProductName: Microsoft Office 2013
ProductVersion: 15.0.4420.1017
Translation: 0x0000 0x04e4

BScope.Worm.Mabezat also known as:

Bkav	W32.AIDetectMalware
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
Avast	Win32:Agent-AVCE [Trj]
FireEye	Generic.mg.51c54f6c0418c135
SentinelOne	Static AI – Suspicious PE
Kingsoft	Win32.Mabezat.b.1038191
Microsoft	Virus:Win32/Mabezat.gen
Cynet	Malicious (score: 100)
McAfee	GenericRXAA-AA!51C54F6C0418
VBA32	BScope.Worm.Mabezat
Rising	Trojan.Bitrep!8.F596 (RDMK:cmRtazrF7n+8BInsKKa49mwcwrUy)
Ikarus	Trojan.Win32.Agent
AVG	Win32:Agent-AVCE [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

How to remove BScope.Worm.Mabezat?

BScope.Worm.Mabezat removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X