Academy
Historical caseWindowsEmail worm (VBScript)
DR-NOS-03

Anna Kournikova

In February 2001, an email attachment claiming to be a photo of tennis player Anna Kournikova flooded mail servers across Europe and North America within hours. The worm had been made with a “worm generator” kit that required no coding skills. Its damage stayed far below ILOVEYOU, but it spread almost as fast.

Based on reports from 55 companies, the FBI estimated the damage at about 166,000 dollars; the court found the report lacking in detail.

Anna Kournikovaemail wormVBScript2001

Activity map

Wikipedia

Activity mapHere you have, ;o)Known senderVBSAnnaKournikova.jpg.vbswscript.exeWindows Script HostAnna KournikovaWormAddress bookAll contactsMass mailingOne email per contactRegistry markerOnTheFly26 JanuaryA Dutch site opens
Executable payloadFile
Malicious payloadAnna Kournikova · Worm

The worm leaves its own marker in the Registry. It checks this marker so it does not spread twice from the same computer.

First seen
11–12 February 2001
Delivery
Email attachment AnnaKournikova.jpg.vbs
Region
Europe, North America
Type
Email worm (VBScript)
01

Overview

The user receives “Hi: Check This!” from someone they know. The attachment is AnnaKournikova.jpg.vbs; because the extension is hidden, it looks like a photo. Once opened, the script mails itself to everyone in the Outlook address book. It only spreads on machines that had not installed the Outlook security update released after ILOVEYOU.

Also known as: VBS.SST, OnTheFly

02

Timeline

  1. 11 February 2001Its 20-year-old Dutch author posted the worm to a newsgroup. Wikipedia
  2. 12 February 2001The worm spread worldwide; some US federal agencies were affected. Wikipedia
  3. 13 February 2001The press reported that the worm had not caused the major damage expected. The Register
  4. 14 February 2001The author turned himself in to Dutch police. Wikipedia
  5. September 2001A court in Leeuwarden sentenced him to 150 hours of community service; the ruling was upheld on appeal. The Register
03

Infection chain

  1. 1

    An email with the subject “Here you have, ;o)” arrives from someone you know.

    • The body has a single line: “Hi: Check This!” It suggests a photo is attached.
  2. 2

    The attachment looks like a photo of tennis player Anna Kournikova.

    • Its name is AnnaKournikova.jpg.vbs. With the extension hidden, only .jpg shows.
  3. 3

    When opened, Windows runs the file as a script.

    • The code was built with an off-the-shelf worm creation tool.
  4. 4

    The worm leaves its own marker in the Registry.

    • It checks this marker so it does not spread twice from the same computer.
  5. 5

    Everyone in the Outlook address book is read.

    • It only spreads on machines without the Outlook security update released after ILOVEYOU.
  6. 6

    The same email is sent to everyone in the address book.

    • Damage reported to the FBI by 55 companies was estimated at $166,000.
  7. 7

    On 26 January the browser opens the site of a computer shop in the Netherlands.

    • No files are deleted and no passwords are stolen. The damage comes from traffic that fills mail servers.
04

How it came to light

The worm was produced with a ready-made “VBS Worm Generator” kit published by an Argentine programmer. Seeing how far it had spread, the author posted an apology on his website and turned himself in to police two days later. The case became one of the first examples showing that someone without coding skills could start a global outbreak.

05

Who was affected

Based on reports from 55 companies, the FBI estimated the damage at about 166,000 dollars; the court found the report lacking in detail. The main impact was the traffic load on mail servers and organizations having to write rules to block email attachments.

06

Relevance today

Ready-made generator kits have turned into subscription malware services: infostealer families are rented monthly and come with a control panel and updates. Not needing coding skills to become an attacker was an exception in 2001; today it is a business model.

07

Sources

  1. 1“Anna Kournikova (computer virus)” · Wikipedia
  2. 2“Kournikova virus kiddie gets community service” (2001) · The Register
  3. 3“Kournikova worm creator loses appeal” · Pinsent Masons Out-Law
  4. 4“Anna Kournikova hits federal agencies” (2001) · Government Executive
  5. 5“Anna Kournikova bug drops harmlessly” (2001) · The Register
Article details
Category
Case analysis
Type
Email worm (VBScript)
First seen
11–12 February 2001
Tags
  • Anna Kournikova
  • email worm
  • VBScript
  • 2001

More cases

2008–2009Worm, botnet agentPalevo (Mariposa botnet)In 2009, MSN Messenger users received short messages such as “is this you on pic?” with a photo link from their friends. The link was not a photo but the Palevo worm. The Mariposa botnet built with Palevo controlled around 12.7 million computers in more than 190 countries when it was taken down in December 2009.Read more August 2008Social network worm, botnetKoobfaceIn 2008, Facebook and MySpace users received a video link from their friends. The video would not play and said a Flash Player update was required. The download was Koobface: a worm that used the hijacked account to send the same message to the whole friend list, collected credentials and sold fake antivirus. The group behind it was publicly identified only in 2012.Read more Mid-2000sPassword stealer (a forerunner of infostealers)LdPinch (Pinch)In the mid-2000s, ICQ was the most widely used instant messenger on the Russian-speaking internet, and short, memorable ICQ numbers (UINs) were worth money. In May 2008, Kaspersky reported that ICQ number theft had been going on for years and was carried out mainly with the LdPinch family. LdPinch collected not only ICQ but also email, FTP and gaming accounts.Read more

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

View productCompare plans