What is “Trojan:Win32/Phonzy.A!ml”?

The Trojan:Win32/Phonzy.A!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.A!ml virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Phonzy.A!ml?


File Info:
name: 1098F1CE48B5D89EE14B.mlw
path: /opt/CAPEv2/storage/binaries/fee792119f7b6fa20797fed82618204a42745eabf480eef20ed9af699faf1169
crc32: 00257938
md5: 1098f1ce48b5d89ee14b1d256531d4f1
sha1: 1ec6940bde7b85ef336a4af5abc5375908d0def8
sha256: fee792119f7b6fa20797fed82618204a42745eabf480eef20ed9af699faf1169
sha512: 0c77aeb818245c03d0a8cf54b2e2c1c14e3440f3c4774926bc2272931f0d6af71036af039d06da265abb91eeda8542b5c23071bc4e7f05523cdd0a41fa8e5b70
ssdeep: 6144:qfKRwAwAaequcDMuYTuM8bPBhukn7HMeEW3atAObhPQv:qfKRwAwjtuwMuYTuHbPB0kmF
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T140643A10B640E076F5A302332AEDDADA85AC7C314BD908D7B3844EBADA793E09735757
sha3_384: 6d83197db11e8858c17e2c90ceebc1e382e27d2f774f948551a550b44034a7bbc932fa8b8c4db95c059f4ca4512c9165
ep_bytes: e80d0b0000e974feffff8b4df464890d
timestamp: 2023-11-09 21:30:47

Version Info:
FileVersion: 2.0.0.1
LegalCopyright: 2022-2023 All rights reserved
Translation: 0x0409 0x04b0

Trojan:Win32/Phonzy.A!ml also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Lazy.388986
Skyhigh	GenericRXWM-CV!1098F1CE48B5
ALYac	Gen:Variant.Lazy.388986
Zillya	Trojan.Agent.Win32.3774189
K7AntiVirus	Trojan ( 005adb6a1 )
Alibaba	Trojan:Win32/Generic.c448a3c5
K7GW	Trojan ( 005adb6a1 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.AFZQ
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	UDS:Trojan.Win32.Generic
BitDefender	Gen:Variant.Lazy.388986
Avast	Win32:PWSX-gen [Trj]
Tencent	Trojan.Win32.Agent.kbf
F-Secure	Heuristic.HEUR/AGEN.1305900
VIPRE	Gen:Variant.Lazy.388986
Emsisoft	Gen:Variant.Lazy.388986 (B)
Ikarus	Trojan.SuspectCRC
Jiangmin	Trojan.Generic.hrvzt
Varist	W32/S-0960b900!Eldorado
Avira	HEUR/AGEN.1305900
Antiy-AVL	Trojan/Win32.Agent
Microsoft	Trojan:Win32/Phonzy.A!ml
Arcabit	Trojan.Lazy.D5EF7A
ZoneAlarm	UDS:Trojan.Win32.Generic
GData	Gen:Variant.Lazy.388986
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R622035
McAfee	GenericRXWM-CV!1098F1CE48B5
VBA32	Trojan.Phonzy
Malwarebytes	Malware.AI.27822123
Panda	Trj/Genetic.gen
Rising	Trojan.Agent!8.B1E (TFE:1:dzXmzaXH7GT)
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Agent.ADKJ!tr
BitDefenderTheta	Gen:NN.ZexaF.36680.sy0@aqpWsFgi
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_60% (D)

How to remove Trojan:Win32/Phonzy.A!ml?

Trojan:Win32/Phonzy.A!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X