Trojan

Trojan:Win32/Phonzy.A!ml (file analysis)

Malware Removal

The Trojan:Win32/Phonzy.A!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:Win32/Phonzy.A!ml virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid

How to determine Trojan:Win32/Phonzy.A!ml?



File Info:

name: 644D19F1CF80FE51D9A8.mlw
path: /opt/CAPEv2/storage/binaries/0471e32e650c15d2e39a4baaa6baa41bd0f7e9e66c24bdffa810ce742afc46f5
crc32: 2D1EFE05
md5: 644d19f1cf80fe51d9a804d5059d14ea
sha1: 904969667c53bc36523aee4ebdf1091caf95dc50
sha256: 0471e32e650c15d2e39a4baaa6baa41bd0f7e9e66c24bdffa810ce742afc46f5
sha512: 172eed3b5cd6c96dbab6369a078b7093f4195989414cb54b50c002c0ca25fd756ea3c0350f2d4ab125a8d9b5a9e449accafe53d093ff941b217e3d5fc4bad910
ssdeep: 12288:dAVPpbOvU3mLzGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:OVRbNWLCt/sBlDqgZQd6XKtiMJYiPU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F0850223B546A0B0C99F23763C5FAB3AD630591C5B0904C3E3E07E6ADE283D55877A5E
sha3_384: ca86e26eac783346fdc24de670247f57c3c78c5dabd61dbbb20704d32f22b6ec82d11e5f362cceeacac9d1ffcd0e2610
ep_bytes: e805000000e978feffff8b0d0c004300
timestamp: 2021-11-03 15:18:26


Version Info:

Comments: 
LegalCopyright: License: MPL 2
CompanyName: Mozilla Foundation
FileDescription: 
FileVersion: 94.0.1
ProductVersion: 94.0.1
InternalName: 
LegalTrademarks: Mozilla
OriginalFilename: crashreporter.exe
ProductName: Firefox
BuildID: 20211103134640
Translation: 0x0000 0x04b0

Trojan:Win32/Phonzy.A!ml also known as:

BkavW32.AIDetectMalware
LionicVirus.Win32.Expiro.n!c
MicroWorld-eScanWin32.Expiro.Gen.7
FireEyeGeneric.mg.644d19f1cf80fe51
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Sality.tt
ALYacWin32.Expiro.Gen.7
Cylanceunsafe
SangforTrojan.Win32.Save.a
K7AntiVirusVirus ( 005a8b911 )
AlibabaVirus:Win32/Moiva.e44b01c0
K7GWVirus ( 005a8b911 )
CrowdStrikewin/malicious_confidence_100% (D)
ArcabitWin32.Expiro.Gen.7
SymantecW32.Xpiro.J!dam
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Expiro.NDP
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Malware.Expiro-9941636-0
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
AvastWin32:FileInfector-C [Heur]
TencentVirus.Win32.VirMoiva.a
TACHYONVirus/W32.Movia
SophosW32/Moiva-C
F-SecureMalware.W32/Infector.Gen
DrWebWin32.Expiro.158
VIPREWin32.Expiro.Gen.7
TrendMicroVirus.Win32.EXPIRO.JMA
EmsisoftWin32.Expiro.Gen.7 (B)
IkarusVirus.Win32.Expiro
VaristW32/Expiro.AU.gen!Eldorado
AviraW32/Infector.Gen
Antiy-AVLVirus/Win32.Expiro.x
MicrosoftTrojan:Win32/Phonzy.A!ml
ZoneAlarmVirus.Win32.Moiva.a
GDataWin32.Expiro.Gen.7
GoogleDetected
AhnLab-V3Malware/Win.IS.C5064324
MAXmalware (ai score=84)
VBA32Trojan.Sabsik.TE
MalwarebytesVirus.M0yv
PandaW32/Moyv.A
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/Expiro.NDP!tr
AVGWin32:FileInfector-C [Heur]
Cybereasonmalicious.67c53b
DeepInstinctMALICIOUS

How to remove Trojan:Win32/Phonzy.A!ml?

Trojan:Win32/Phonzy.A!ml removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment