Should I remove “Trojan:Win32/Phonzy.A!ml”?

The Trojan:Win32/Phonzy.A!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.A!ml virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Phonzy.A!ml?


File Info:
name: EAC8A965E13F0247286E.mlw
path: /opt/CAPEv2/storage/binaries/900b9b855d503c05827244840c534c4c0e5e716c5f7515f9cc525fa718e5a340
crc32: D7206F88
md5: eac8a965e13f0247286ebceada715bac
sha1: ecac5402b38ef0f609722cff739fcd0eb66ecbf4
sha256: 900b9b855d503c05827244840c534c4c0e5e716c5f7515f9cc525fa718e5a340
sha512: 985ea55263f3c5647ddcb28fa025cd128f1ba5f1d98dc7dd95e7b11e29a9e83cdf833e18750f186bbb59227a9c1c98c3b5919ee9bae821a87e0695f4e730d183
ssdeep: 98304:csgiym3ezm6sMTBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64TRRbCvE:csmm3gsMTVHJack+YlGlSRRbCvE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E166F173F0DA1471F8732A36B8A25432393E089CE08729A929F46BD7F572D485F4B791
sha3_384: edadc730329ec0f90b962c5ab434c29661ea348c73317068c554d68c9af2d05220b62eedc00406cc778a22f33a77c2d0
ep_bytes: 5589e583ec08c7042402000000ff1590
timestamp: 2023-08-14 15:34:32

Version Info:
CompanyName: Lohika
FileDescription: Millions trust Grammarly's free writing app to make their me
FileVersion: 12.9.2.4
InternalName: SoldierMedian.exe
Copyright: All reserved
OriginalFilename: SoldierMedian.exe
ProductName: Design Addition
ProductVersion: 12.9.2.4
Translation: 0x0409 0x04e4

Trojan:Win32/Phonzy.A!ml also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Cobalt.4!c
MicroWorld-eScan	Trojan.GenericKD.70063003
FireEye	Trojan.GenericKD.70063003
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.70063003
Cylance	unsafe
Zillya	Trojan.Cobalt.Win32.3118
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanDownloader:Win32/Cobalt.8e284837
K7GW	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D42D139B
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Java/TrojanDownloader.Agent.NWR
Cynet	Malicious (score: 99)
Kaspersky	Trojan.Win32.Cobalt.rbl
BitDefender	Trojan.GenericKD.70063003
NANO-Antivirus	Trojan.Win32.Cobalt.jyxigj
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.13edf090
Emsisoft	Trojan.GenericKD.70063003 (B)
F-Secure	Malware.JAVA/Dldr.Agent.joxbf
VIPRE	Trojan.GenericKD.70063003
TrendMicro	TrojanSpy.Win32.REDLINE.YXDHOZ
Sophos	Mal/Generic-S
Webroot	W32.Malware.Gen
Varist	W32/ABRisk.NUII-1199
Avira	JAVA/Dldr.Agent.joxbf
Kingsoft	Win32.Trojan.Cobalt.rbl
Xcitium	Malware@#2ksijg9tmnd7s
Microsoft	Trojan:Win32/Phonzy.A!ml
ZoneAlarm	Trojan.Win32.Cobalt.rbl
GData	Trojan.GenericKD.70063003
Google	Detected
McAfee	Artemis!EAC8A965E13F
MAX	malware (ai score=82)
Malwarebytes	Trojan.Dropper.PYI
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXDHOZ
MaxSecure	Trojan.Malware.219067915.susgen
Fortinet	PossibleThreat.PALLASNET.H
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Phonzy.A!ml?

Trojan:Win32/Phonzy.A!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X