What is “Trojan:Win32/Phonzy.B!ml”?

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

• Sample contains Overlay data
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Traditional)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Phonzy.B!ml?

File Info:
name: A3C95091D3687DBA3E1C.mlw
path: /opt/CAPEv2/storage/binaries/2041dbacf3ec9d5a816efee87ab89407666d11dfc587e10e84022d56222ab5c5
crc32: 5E780273
md5: a3c95091d3687dba3e1c51b7bb32a9b6
sha1: 550acc31895617fb33cf6e132e6d27436f8cafbc
sha256: 2041dbacf3ec9d5a816efee87ab89407666d11dfc587e10e84022d56222ab5c5
sha512: 6d4764a7fb9d9fa5014abdf04961767fb74c8b969b996cb74a655e708d02f29a39f6e1770dcb1d7e806f78da06f8cc3243c996f9b508e716f957ccd657d6c56e
ssdeep: 98304:jmJ7T/OcgFRp/pRrZPpFpi0qLobGJeSi0/nUBVSbiG:jUTmlRpRRtPpFptibJeSioUjSp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13A063348FE04EC0BD416243DBBF441D979B921DFB78A670885E3EA2B1A75D2D0E5836C
sha3_384: afb044cbec4d3f19ecc569e29d6b797a422cd4f0a8435fd14eea4fb8f704542e253102db07ba188bbcff3f4497bc0615
ep_bytes: 60be00b040008dbe0060ffff5783cdff
timestamp: 2009-07-10 12:55:44

Version Info:
CompanyName: Egis Technology Inc.
FileDescription: MyWinLocker SelfExtractor
FileVersion: 3.0.40.0
InternalName: SelfExtractor.exe
LegalCopyright: Copyright 2008 (C) EgisTec Inc. All right reserved.
OriginalFilename: SelfExtractor.exe
ProductVersion: 3.0.40.0
Translation: 0x0409 0x04b0

Trojan:Win32/Phonzy.B!ml also known as:

How to remove Trojan:Win32/Phonzy.B!ml?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.