Trojan:Win32/Fleercivet.A

Installation

On other systems, it will inject code in explorer.exe and in one of the following processes, depending on the version of Windows that is running:

• explorer.exe
• svchost.exe 
• dwm.exe
• taskhostex.exe

It also starts a hidden iexplore.exe process, where it injects more code. 

It can also write encrypted data to the files in:

• <commonappdata>\wrnhoah.tmp
• %TEMP%\wrnhoah.tmp.

Payload

Clicks on advertisements

The malware starts an invisible Internet Explorer process and contacts a server which responds with a list of URLs to visit.

Examples of servers include the following:

It then sends clicks to the listed URLs to generate advertising revenue. It might attempt to mute the sound for the browser process so that any audio content of the visited sites are not heard.

Changes browser settings

This threat tries to change various settings, including your start page, for various web browsers, including Firefox and Opera.

Stops processes

The malware collects data about the affected system, encrypts it, then sends it to a remote server, such as 95.211.73.249. The data collected can include:

• Country where the infected system is located (It obtains this information by contacting a web server at telize.com)
• PC Name
• IP Address
• Operating System version
• Operating System install date
• Current system time
• Processor type (64 or 32-bit)

The malware typically does this to:

It requests data from a number of remote servers, which can include the following:

• 176.102.38.69
• 176.102.38.72
• 95.211.73.249

It saves the data it receives to <commonappdata>\@system.att, and copy this file to <commonappdata>\@system2.att.