MALICIOUS — FACTURA ELECTRÓNICA DISPONIBLE PARA PROCESO CONTABLE CON NUESTRA ENTIDAD BANCARIA.js

MALICIOUS — FACTURA ELECTRÓNICA DISPONIBLE PARA PROCESO CONTABLE CON NUESTRA ENTIDAD BANCARIA.js is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (81/100), attributed to the Qwexlafiba family. 4 of 23 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: dea1847c964c08cb6bcbddca7fd3ccffbaa3ce8c0989fbf5717b3c93e5506f47
• SHA-1: a531c9b32831b455e2abb52bc58e25bf0147611e
• MD5: 807c16ccff2e94203d10f8ad6f6c57fe
• ssdeep: 768:Ft/fTuTja6nw8naehbBhgsmYmwqDOvLFyoPR6jG8b7fhrGW3qY6Og8UrRorOt1BJ:P3OmUX
• TLSH: T148754769CB11CAB07DA816F8539A5D224DD5C81FEC7D368A9FF3C59AC9C80B180073A5
• Submitted as: FACTURA ELECTRÓNICA DISPONIBLE PARA PROCESO CONTABLE CON NUESTRA ENTIDAD BANCARIA.js
• File type: unknown · Size: 27462070 bytes
• Verdict: malicious (81/100) · Family: Qwexlafiba

Detections (4 of 23 engines)

• capa (capabilities): capability:execution/powershell
• Microsoft Defender: Trojan:Win32/Qwexlafiba!rfn
• Emsisoft (Emergency Kit): GT:JS.Agent.1013.B9FCA0C2
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1059.001

Why this verdict

The malicious score of 81/100 is the fusion of 3 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Qwexlafiba!rfn (rule Trojan:Win32/Qwexlafiba!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged GT:JS.Agent.1013.B9FCA0C2 (rule GT:JS.Agent.1013.B9FCA0C2) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80

Registry keys

• HKCU\Environment)

More Qwexlafiba samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report