How to remove “Generic.Mulinex.80ECB5A5”?

The Generic.Mulinex.80ECB5A5 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Mulinex.80ECB5A5 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Guard pages use detected – possible anti-debugging.
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities for basic functionality
• Deletes executed files from disk
• Empties the Recycle Bin, indicative of ransomware
• Uses suspicious command line tools or Windows utilities

How to determine Generic.Mulinex.80ECB5A5?

File Info:
name: 3FD183EA2F0CD9C477A6.mlw
path: /opt/CAPEv2/storage/binaries/847ac810505052bf98b97bd4023f767d491340fdf86d3b809c45bad5ad190d0e
crc32: 3C02D3D4
md5: 3fd183ea2f0cd9c477a6e7593eda229e
sha1: 2db524ebf1da15a37b3e35a6c063b692a124c238
sha256: 847ac810505052bf98b97bd4023f767d491340fdf86d3b809c45bad5ad190d0e
sha512: 403d9bdbd56aba94df5fad22af432b3b6074ed9d10de35d0749ed1a2a12e7e4e98e691140151305449236dbc53e06ecf174f8f3603ad2954328c79e9d4e66533
ssdeep: 12288:wRvNbB/tK0mq//ZKGbtlqttaeCDDHO3pa0uf6TFj1W/DcekDuJUu:aO0mq/8GbCttDCfu5EfgFBoDR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T155C41227AB14C972E04C0D368C638BB15F247D6489E24E5F7AF5BF8DFC702917A0A54A
sha3_384: c40fcd5ce1ec9adf046a4a38f234d5ea1a821185cbc480bd64f9accd7895d67a1c9a673db954e07e48d070612e3cdd2a
ep_bytes: 60be00f04d008dbe0020f2ff5783cdff
timestamp: 2022-06-13 10:48:22

Version Info:
CompanyName: CIB
FileDescription: CIB EBanking Assistant
FileVersion: 3.0.1.5
LegalCopyright: Copyright(C) 2012 CIB
ProductName: CIB EBanking Assistant
ProductVersion: 3.0.1.5
Translation: 0x0409 0x04b0

Generic.Mulinex.80ECB5A5 also known as:

How to remove Generic.Mulinex.80ECB5A5?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.