Should I remove “JS/Chromex.Agent.BQ”?

The JS/Chromex.Agent.BQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What JS/Chromex.Agent.BQ virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Detects Bochs through the presence of a registry key
• Attempted to write directly to a physical drive
• Loads Chromium browser extension from directory
• CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealing
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine JS/Chromex.Agent.BQ?

File Info:
name: 1D3918CE1C93A4FC82E9.mlw
path: /opt/CAPEv2/storage/binaries/02a810d1e5bbd5f9ad0532af725712f6c150749649d526cbaff8b90d68165316
crc32: 6D61715F
md5: 1d3918ce1c93a4fc82e9262bd386b117
sha1: 64ed6fb2896d76c7645f8f24200b7adc6226ec83
sha256: 02a810d1e5bbd5f9ad0532af725712f6c150749649d526cbaff8b90d68165316
sha512: 3920d568f6e6578702a970312282c71676384282980c9e03ea57443d62d1344ccbc249c02b3dfeb90f8a98d0086306801f13d2d622192b49b88b791bcbef9141
ssdeep: 6144:rTouKrWBEu3/Z2lpGDHU3ykJfX+tNC/xKoBRc:rToPWBv/cpGrU3yuX+tNGxb2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A074CF02BAC198B2D4731D326A396B21A93DBD202F65CEDF63D42A5DDA315C0DB31772
sha3_384: d0c14a274bb772c70a9c850e4d149dade1bd3bfeb26e63d1ebcf1b416741930023544f9c70a7669cd3be6ddcb86bf4ad
ep_bytes: e866050000e978feffffcccccccccccc
timestamp: 2022-03-03 13:15:57

Version Info:
0: [No Data]

JS/Chromex.Agent.BQ also known as:

How to remove JS/Chromex.Agent.BQ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.