What is “Trojan:Win32/Phonzy.B!ml”?

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• A HTTP/S link was seen in a script or command line
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Behavioural detection: Transacted Hollowing
• CAPE detected the shellcode get eip malware family
• Detects Bochs through the presence of a registry key
• Checks the version of Bios, possibly for anti-virtualization
• Attempted to write directly to a physical drive
• Attempts to modify proxy settings
• Touches a file containing cookies, possibly for information gathering
• Collects information to fingerprint the system
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Phonzy.B!ml?

File Info:
name: 935B12573F053FE6FA4E.mlw
path: /opt/CAPEv2/storage/binaries/0cb7728a642bb8db1da8ecad3066c2590e84c4a9baea3844a9e99cc9f67ef80d
crc32: D7EF952B
md5: 935b12573f053fe6fa4e9c01adb9f837
sha1: 924ba29c44bbea08eae881851c0689915007d756
sha256: 0cb7728a642bb8db1da8ecad3066c2590e84c4a9baea3844a9e99cc9f67ef80d
sha512: 06438f6d4368a4f83630c3c0334d1bbba23b9435817cec4fd109a4424ab45eaa595b7988024e37875daf4e523bb48cbde9f1be920e2d8e47e0d09b4b6016db5b
ssdeep: 768:mMA1v8bOqbMrmzirK04rd3ipmDEzZguqfpHOUbG:6v8bOqbOmzEK04rd3i0EzZWi
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T172F24A03B1A18073D52102B0256B876783BF79766B23A3C377C99DAB5A396E17973037
sha3_384: d15f7436d2a5cb56bbd95397518d18b835b8b30319a0786bbf035dc05a80654fcf43ffde3cde70a42bd3e7bf2fdc979c
ep_bytes: e8d5050000e974feffffc20000558bec
timestamp: 2023-01-21 11:53:44

Version Info:
0: [No Data]

Trojan:Win32/Phonzy.B!ml also known as:

How to remove Trojan:Win32/Phonzy.B!ml?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.