According to newswire reports, the Spanish YouTuber is also condemning actions against Islam, including the threats of pastor Terry Jones in the US to burn copies of the Koran earlier in the month.
Luis Corrons, technical director with Spain's PandaLabs, says his team have been investigating the malware, which first appeared about a month ago, and concluded that the worm - which spreads via social engineering - is of Spanish origin.
Corrons says that the YouTube video appears to come from the Iraq Resistance leader of Tarek Bin Ziad group, and was posted last Sunday, with a metallic female voice explaining why the group sent out the malware.
In his security posting on the malware, Corrons says that the video claims the worm was created to target the US for two reasons: to commemorate the 9/11 attacks and to demand respect for Islam, with reference to the threat made by pastor Terry Jones to burn the Koran last week.
The video displays, he says, a static image of a map of Andalusia, Spain along with a photo and an emblem, presumably that of the group.
Corrons, whose research team has a track record in tracking down unusual malware creators, says he has passed on his team's data files to the Spanish Civil Guard's digital crime unit for their investigation.
The code of the malware, he says, also suggests that its creators may be based in Spain, as there is also the link between the name of the group and the Berber general who led the conquest of Al-Andalus.
Tariq ibn Ziyad, he added, was a Berber commander who died in AD 720 and led the Muslim invasion of the Iberian Peninsula in the eighth century, conquering Visigoth Hispania.