About “GenPack:Generic.Mulinex.49738A2D (B)” infection

The GenPack:Generic.Mulinex.49738A2D (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What GenPack:Generic.Mulinex.49738A2D (B) virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Guard pages use detected – possible anti-debugging.
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Executable file is packed/obfuscated with MPRESS
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities for basic functionality
• Empties the Recycle Bin, indicative of ransomware
• Uses suspicious command line tools or Windows utilities

How to determine GenPack:Generic.Mulinex.49738A2D (B)?

File Info:
name: 453183756FBBF6F8869C.mlw
path: /opt/CAPEv2/storage/binaries/e566340cd8d2acfd97d2b3692b288316be76ac2672b2860bc02a36617457dd45
crc32: DBC07C63
md5: 453183756fbbf6f8869c9acfeae93c58
sha1: 42b14d1ca84ad200e495730eb0b0edac5983fcb9
sha256: e566340cd8d2acfd97d2b3692b288316be76ac2672b2860bc02a36617457dd45
sha512: db607fc4004631e7f277b49f831c1c1ba8b704998e9cb7c577e6a74bddc635f09bb53efb0a25584a3280800d3063f54f7faf1f699bc6e49fd0d7816eda84e916
ssdeep: 6144:vdg1ItuNpBfTPcPPdpo2iy/kaBPE2EXER55VoZZasM5vssDL/pykeXkSctDXxxEm:vsxpBbIkhycgXa4Vo/C5vdfqUWQG1BQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A384230EA82DEA7CD5531134C9A306451B63F5EE9172CF1F2EB16C729C2A7E80B957E0
sha3_384: 7d355e42b89e3ece23b356103fc687221377fad22a7479a3c14c2437acd5f79095c46e7918c870646ac6953f558a2a82
ep_bytes: 60e80000000058055a0b00008b3003f0
timestamp: 2021-11-02 12:28:06

Version Info:
CompanyName: Babylon Software Ltd.
FileDescription: Babylon Setup SE
FileVersion: 10.1.0.0
InternalName: Setup Stub
LegalCopyright: Copyright © Babylon Software Ltd. 1997-2016
OriginalFilename: SetupStub.exe
ProductName: Babylon Setup
ProductVersion: 10.1.0.0
Translation: 0x0409 0x04b0

GenPack:Generic.Mulinex.49738A2D (B) also known as:

How to remove GenPack:Generic.Mulinex.49738A2D (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.