Feeds

Vandals behind spread of Hybris worm named

Users blitzed by malicious code via email

  • alert
  • submit to reddit

The smart choice: opportunity from uncertainty

Vandals behind the spread of an irritating and potentially dangerous virus have being tracked down to Brazil.

For weeks users, including us here at The Register, have received numerous emails from hahaha@sexyfun.net with attachments that appear to be Snow White-related porn but which actually contain the Hybris worm.

Hybris is an Internet worm that spreads itself as an attachment to email messages, and affects only Windows systems. The worm contains components (plug-ins) in its code that are executed depending on what worm needs, and these components can be upgraded from a Web site. The worm has polymorphic attributes, which means that it can appear in a variety of forms, and its behaviour is determined on the set of installed components.

When run, the worm infects WSOCK32.DLL. Whenever an email is sent, the worm attempts to send a copy of itself as an attachment to a separate message to the same recipient. This means that the virus is being spread by infected users to people they know, not via a spam campaign. The address the virus appears to come from is a fake - which has made identifying the people ultimately responsible for its spread more difficult.

However, security firm Aladdin Knowledge Systems said that its Content Security Response Team (CSRT) has tracked down the people responsible for launching the attack, which it identifies as a Brazilian group called VX-BRAZIL. The group is well known in anti-virus circles and its members include Alevirus, Delta, Kamaileon, NBK, Eu and Vecna, whose name actually appears inside the malicious code itself.

MessageLabs, a UK-based firm which filters users' email for malicious code, said that it had intercepted more than 2000 copies of Hybris, all of which came from hahaha@sexyfun.net. The virus can also be identified because one of four subjects is likely to be listed. These are: Snowhite and the Seven Dwarfs - The REAL story!; Branca de Neve porne!; Les 7 coquir nains; and Enanito si, pero con que pedazo!

The attached file within the email will likely have one of 16 names. The most common include 'midgets.scr', 'dwarf4you.exe' and 'blancheneige.exe' However, variants of the infected email may include a host of other subjects and attached file names.

As well as having an up-to-date virus scanner, users can also help to curtail the spread of the virus, should they be able to identify the source of these emails sent to them, by warning people they are infected. As always users are advised not to open attachments they are not sure about and to delete any suspicious email as a matter of course. ®

Related Stories

Virus infection rates soar
Virus writers and cracker love-in
Viruses prey on porn lovers

Securing Web Applications Made Simple and Scalable

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.