Trojan:Win32/Phonzy.B!ml malicious file

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Phonzy.B!ml?


File Info:
name: CA6C1551B19A1977D087.mlw
path: /opt/CAPEv2/storage/binaries/76ea0a7e57358cb122d3e5ce72b10d985c8bf05e43a2841dd105a896820b2439
crc32: D7D146F6
md5: ca6c1551b19a1977d0870a41f2512a8b
sha1: e6626509f7d26e28fc144e14321ed182cc256ed5
sha256: 76ea0a7e57358cb122d3e5ce72b10d985c8bf05e43a2841dd105a896820b2439
sha512: 3d51c03fe207135796d8abbe66d1a8e5f49755e9f3ba93148471a4d6a744dfb1dcd2b7afa3419c2808d9da09baef04c684b61090f0c2956c0c2a2b08e617d440
ssdeep: 768:0zInlumpuE7r97LcRRGBViF6YOVyguVECBXem7:ZlPZ97YRRGzHVygutNe
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12424B60263F86604F1FB5B705DB787A60AB6BC467939CE1E6250BA4F6C71A50C87133B
sha3_384: 4a12af557aec4b14f14a044be4c4ef5c04c5fe3e1ab63d91abd1ad8d56bc5be4c75bfdf222cffa6596ef854dca9311ea
ep_bytes: 60be003067018dbe00e0d8fe5783cdff
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Trojan:Win32/Phonzy.B!ml also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Poker.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	Artemis!Trojan
McAfee	GenericRXAA-AA!CA6C1551B19A
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 00550a831 )
K7GW	Trojan ( 00550a831 )
Cybereason	malicious.9f7d26
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Malware.Generic-9956637-0
Avast	Win32:Evo-gen [Trj]
F-Secure	Malware.W32/Poker.A
FireEye	Generic.mg.ca6c1551b19a1977
Sophos	Mal/Generic-S
Ikarus	Trojan.SuspectCRC
GData	Win32.Trojan.Agent.XBNRT2
Webroot	W32.Trojan.Gen
Google	Detected
Avira	W32/Poker.A
Antiy-AVL	Trojan/Win32.ULPM.16c0
Kingsoft	Win32.Infected.AutoInfector.a
Xcitium	Packed.Win32.MUPX.Gen@24tbus
Microsoft	Trojan:Win32/Phonzy.B!ml
Varist	W32/Poker.A.gen!Eldorado
AhnLab-V3	Trojan/Win32.Scar.C149469
Acronis	suspicious
Cylance	unsafe
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/ULPM.16C0!tr
BitDefenderTheta	Gen:NN.ZexaF.36744.nmW@aauNUHoc
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Trojan:Win32/Phonzy.B!ml?

Trojan:Win32/Phonzy.B!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X