Trojan:Win32/Phonzy.A!ml removal guide

The Trojan:Win32/Phonzy.A!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.A!ml virus can do?

Sample contains Overlay data
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Phonzy.A!ml?


File Info:
name: 8D36B9BB72E0BA79805F.mlw
path: /opt/CAPEv2/storage/binaries/2d0e6311b424cf3c2b14aa129ba59774a273857e9d194049ae922c58874bce62
crc32: 06813E9F
md5: 8d36b9bb72e0ba79805f77a658b30f83
sha1: 9943c5186063a844c333173cfda4b0ab63c6c634
sha256: 2d0e6311b424cf3c2b14aa129ba59774a273857e9d194049ae922c58874bce62
sha512: 035877ff4ccc7aaa054f4a12647b7de2eef64e8ac28ccf3ad62865c737eda646068d6f06a271d71a10812aa6ade28f57d1dd5772e444c20e2ece6dbfcce02589
ssdeep: 24576:xowVvqguNIdjKP5hetCQYZmYmJ5D8fZTVK7KEzsl87Pe8KeB5DQrDbs+myrLon1N:SeKrzVxyjbfB50KDTvF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12AA5DF13BB059AA3F392063004A6977B5735A8155B219BC3F14C5BFC6F712C18E3EA6E
sha3_384: 1eab146534e00b59fd9d005346dfadb35a3a361e9b19c2f87e1cc87a9ed0bda85e214839c5dd529b76ff84b3365eb1d6
ep_bytes: e8d9070000e97afeffff558bec6a00ff
timestamp: 2023-04-17 11:37:50

Version Info:
FileVersion: 10.0.22621.1483
OriginalFilename: WUDFHost.exe
ProductName: Windows Driver Foundation (WDF) - host service
ProductVersion: 10.0.22621.1483
Translation: 0x0409 0x04b0

Trojan:Win32/Phonzy.A!ml also known as:

Lionic	Trojan.Win32.Generic.4!c
AVG	Win32:Evo-gen [Trj]
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.496095
FireEye	Gen:Variant.Zusy.496095
Skyhigh	BehavesLike.Win32.BadFile.vc
ALYac	Gen:Variant.Zusy.496095
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Vm9o
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/grayware_confidence_60% (W)
Symantec	ML.Attribute.HighConfidence
Cynet	Malicious (score: 100)
BitDefender	Gen:Variant.Zusy.496095
Avast	Win32:Evo-gen [Trj]
Emsisoft	Gen:Variant.Zusy.496095 (B)
VIPRE	Gen:Variant.Zusy.496095
Sophos	Mal/Generic-S
Ikarus	Trojan.Agent
GData	Gen:Variant.Zusy.496095
Jiangmin	Trojan.Generic.hsbyn
Varist	W32/ABRisk.EMML-5097
Antiy-AVL	Trojan/Win32.Malgent
Arcabit	Trojan.Zusy.D791DF
Microsoft	Trojan:Win32/Phonzy.A!ml
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R626147
McAfee	GenericRXAA-AA!8D36B9BB72E0
MAX	malware (ai score=87)
Malwarebytes	Malware.AI.3708636338
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R011H09J323
Rising	Trojan.Generic@AI.90 (RDML:oHdpQAN+jGFk+p+SoO3ifw)
MaxSecure	Trojan.Malware.218791894.susgen
Fortinet	W32/PossibleThreat
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Phonzy.A!ml?

Trojan:Win32/Phonzy.A!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X