From: Harvey Newstrom (mail@HarveyNewstrom.com)
Date: Thu Feb 01 2001 - 22:47:22 MST
Vandals behind spread of Hybris worm named
By: John Leyden
Posted: 10/01/2001 at 14:18 GMT
<http://www.theregister.co.uk/content/4/15964.html>
Vandals behind the spread of an irritating and potentially dangerous
virus have being tracked down to Brazil.
For weeks users, including us here at The Register, have received
numerous emails from hahaha@sexyfun.net with attachments that appear
to be Snow White-related porn but which actually contain the Hybris
worm.
Hybris is an Internet worm that spreads itself as an attachment to
email messages, and affects only Windows systems. The worm contains
components (plug-ins) in its code that are executed depending on what
worm needs, and these components can be upgraded from a Web site. The
worm has polymorphic attributes, which means that it can appear in a
variety of forms, and its behaviour is determined on the set of
installed components.
When run, the worm infects WSOCK32.DLL. Whenever an email is sent,
the worm attempts to send a copy of itself as an attachment to a
separate message to the same recipient. This means that the virus is
being spread by infected users to people they know, not via a spam
campaign. The address the virus appears to come from is a fake -
which has made identifying the people ultimately responsible for its
spread more difficult.
However, security firm Aladdin Knowledge Systems said that its
Content Security Response Team (CSRT) has tracked down the people
responsible for launching the attack, which it identifies as a
Brazilian group called VX-BRAZIL. The group is well known in
anti-virus circles and its members include Alevirus, Delta,
Kamaileon, NBK, Eu and Vecna, whose name actually appears inside the
malicious code itself.
MessageLabs, a UK-based firm which filters users' email for malicious
code, said that it had intercepted more than 2000 copies of Hybris,
all of which came from hahaha@sexyfun.net. The virus can also be
identified because one of four subjects is likely to be listed. These
are: Snowhite and the Seven Dwarfs - The REAL story!; Branca de Neve
porne!; Les 7 coquir nains; and Enanito si, pero con que pedazo!
The attached file within the email will likely have one of 16 names.
The most common include 'midgets.scr', 'dwarf4you.exe' and
'blancheneige.exe' However, variants of the infected email may
include a host of other subjects and attached file names.
As well as having an up-to-date virus scanner, users can also help to
curtail the spread of the virus, should they be able to identify the
source of these emails sent to them, by warning people they are
infected. As always users are advised not to open attachments they
are not sure about and to delete any suspicious email as a matter of
course. ®
-- Harvey Newstrom <http://HarveyNewstrom.com>
This archive was generated by hypermail 2.1.5 : Sat Nov 02 2002 - 08:05:33 MST