Trojan:Win32/Merca.A malicious file

The Trojan:Win32/Merca.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Merca.A virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• The binary contains an unknown PE section name indicative of packing
• The executable is compressed using UPX
• Authenticode signature is invalid
• Detects Bochs through the presence of a registry key
• Checks the version of Bios, possibly for anti-virtualization
• Attempted to write directly to a physical drive
• Harvests information related to installed mail clients
• Collects information to fingerprint the system

How to determine Trojan:Win32/Merca.A?

File Info:
name: 8D46EE2D141176E9543D.mlw
path: /opt/CAPEv2/storage/binaries/e7ef341ad0b17df0b35c191edaa77c0abf2da0d20238cf1e594aa9d0805d3f39
crc32: D3D0F3B5
md5: 8d46ee2d141176e9543dea9bf1c079c8
sha1: 810c8cc0a3eb6e52e42f97ad6dfe511694952989
sha256: e7ef341ad0b17df0b35c191edaa77c0abf2da0d20238cf1e594aa9d0805d3f39
sha512: 770294907911a611674c4b50a23616ddc093ac296581c7424064451b8a85ce207f9a3cdde886fb5eca694abeab4bc737c3f368d87abbc0be91d25e658f619ad6
ssdeep: 49152:CAOD/z+Sf25a2UhSAilFOOwpC6HglLOyThcc3eFiy0p8NJU8iTA7GTR8:C9FOwyLORc3eFM888ik7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T151169F17B288567BD96F0B324837DD949A3DB7A02E1A9C0B57F01D0CCF39E432A26756
sha3_384: f09bcd9079e329242d5530a30816f3883780f1e38db7e6475680dee05721970be19f508281724c1a4a12831f230e3419
ep_bytes: 558bec83c4f0b808201201e80403d3ff
timestamp: 2016-06-07 12:01:47

Version Info:
FileVersion: 1.0.0.0
ProductVersion: 1.0.0.0
Translation: 0x0409 0x04e4

Trojan:Win32/Merca.A also known as:

How to remove Trojan:Win32/Merca.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.