B-List Web Downloader 1.0
(Constructor.Win32.VB.ab)
(Trojan-Downloader.Win32.VB.gu)

by Zed

Written in Visual Basic

Released in December 2004


The downloader will instantly download the specified file and will run it on the specified date. 
The BList Web Downloader was coded in pure win32api to get the smallest possible filesize. 
Also it was designed to use the least memory space.

Zed


Server:
dropped file:
c:\WINDOWS\lsass.exe
size: 3,362 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "System Starter"
data: C:\WINDOWS\lsass.exe 
	
	
tested on Windows XP
November 03, 2005

MegaSecurity