{
  "family": "vbs_worm_generator",
  "sample_count": 0,
  "category": "worm",
  "description": "VBS Worm Generator (widely known as VBSWG and documented in security records as Worm.VBSWG or VBS Worm Generator by [K]Alamar) is an infamous malware construction kit created in mid-2000 by an Argentine programmer known as '[K]Alamar'. Designed as an automated script virus builder, VBSWG allowed non-technical operators to create self-propagating VBScript worms with point-and-click ease. Most notoriously, VBSWG was used by Dutch hacker Jan de Wit ('OnTheFly') in February 2001 to generate the devastating 'Anna Kournikova' worm (VBS.SST / VBS.OnTheFly), which infected millions of computers worldwide within hours. Worms generated with VBSWG replicated by accessing Microsoft Outlook via the MAPI object model to harvest the Windows Address Book and email copies of the worm to every contact. Furthermore, VBSWG worms dropped mIRC script injection hooks (script.ini), searched for local network shares, established registry autostart keys, and could execute auxiliary payload scripts on predetermined dates.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "VBSWG",
    "VBS Worm Generator by [K]Alamar",
    "Worm.VBSWG",
    "VBSWG 1.50",
    "VBSWG 2.0"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the VBS Worm Generator (VBSWG)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "VBSWG is an automated malware authoring toolkit developed by [K]Alamar in 2000 used to create self-replicating VBScript email worms."
      }
    },
    {
      "@type": "Question",
      "name": "Which famous malware was created using VBSWG?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The infamous Anna Kournikova email worm (VBS.SST / VBS.OnTheFly) of February 2001 was generated using VBSWG 1.50b."
      }
    },
    {
      "@type": "Question",
      "name": "How do worms generated by VBSWG propagate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They use Microsoft Outlook MAPI automation to email copies to all contacts in the Windows Address Book, and inject mIRC chat scripts."
      }
    },
    {
      "@type": "Question",
      "name": "How do VBSWG worms maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They copy the .vbs script into the Windows System folder and add execution entries to the registry Run keys."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against VBSWG worms?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block .vbs email attachments at mail gateways, disable Windows Script Host (WSH) on workstations, and enforce endpoint script blocking."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2000,
  "motivation": "Sabotage",
  "lineage": {
    "derived_from": [
      "VBScript Malware Toolkits"
    ],
    "variants": [
      "VBSWG 1.50",
      "VBSWG 2.0",
      "Anna Kournikova Generator"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.005",
    "T1566.001",
    "T1083",
    "T1547.001",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic",
      "tactic": "Execution"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from corporate email networks immediately to halt automated mass-mailing propagation.",
    "Terminate active wscript.exe or cscript.exe process instances.",
    "Delete malicious .vbs script files from %WINDIR% and %TEMP% folders.",
    "Clean persistence entries from HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Disable Windows Script Host by setting HKLM\\Software\\Microsoft\\Windows Script Host\\Settings\\Enabled to 0."
  ],
  "what_to_avoid": [
    "Do not allow executable script file extensions (.vbs, .js, .wsf) to run automatically on Windows workstations.",
    "Avoid opening unsolicited email attachments ending in .vbs."
  ],
  "iocs": {
    "file_hashes": [
      "4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a",
      "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c"
    ],
    "delivery": [
      "Spear-phishing emails containing malicious .vbs attachments sent via Outlook MAPI address book automation",
      "Distribution across hacking forums and tool repositories"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VBSWG_Worm",
      "%WINDIR%\\System32\\AnnaKournikova.jpg.vbs"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - VBS.VBSWG",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletins"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - VBS_KOURNIKOVA.A",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/vbs_kournikova.a"
    }
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}