BrowserModifier:Win32/Xeelyak

Installation

This threat is usually installed through bundlers and other unwanted software like BrowserModifier:Win32/Sasquor and BrowserModifier:Win32/Suptab.

It usually calls itself as 'Yet Another Cleaner' when installed in your PC.

Payload

Drops modified Internet Explorer link

This threat drops modified Internet Explorer link pointing to its affiliate websites.

Modifies default homepage

This threat also changes the default homepage without your consent, by adding the following registry entries:

In subkey: HKCU\Software\Microsoft\Internet Explorer\Main
Sets value: Default_Page_URL
With data: "www.<blocked domain>.com/sof/sof_1506913787_429407"

Adds browser extension and toolbars

This threat also adds Google Chrome extensions without your consent:

It also adds browser extensions and search providers for Internet Explorer by adding the following registry entries:

In subkey: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Sets value: URL 
With data: "http://www.<search domain>.com.br/cse?q={searchTerms}&cx=partner-pub-<publisher id>&tbm=&ie=UTF-8#gsc.tab=0&gsc.q={searchTerms}"

In subkey: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Sets value: DisplayName 
With data: "v9"

Disables Browser Security Settings

This threat also disables the Phishing Filter on old version of Internet Explorer

In subkey: HKCU\Software\Microsoft\Internet Explorer\PhishingFilter 
Sets value: EnabledV9 
With data: DWORD:00000000

Additional information

Displays misleading security information

Aside from the setting changes that this threat does without your consent, Yet Another Cleaner, is also known for displaying misleading security information and annoying pop-up windows.

Analysis by Zarestel Ferrer