Trojan:Win32/Phonzy.B!ml (file analysis)

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Phonzy.B!ml?


File Info:
name: D642C925276D28489F60.mlw
path: /opt/CAPEv2/storage/binaries/c7e842d42b3fb822c02ce540377b8ac0c6623ff82a49dd2bc9b4459ad5d57624
crc32: 21147F1A
md5: d642c925276d28489f601e68019180bd
sha1: 4db4e0faee7df45a2a88ea3528a63b10e07a889d
sha256: c7e842d42b3fb822c02ce540377b8ac0c6623ff82a49dd2bc9b4459ad5d57624
sha512: dbcb413196ef715fefe72ac838a647e2c27a4b9505b739d2d3aa9caa6c8c95dcebc2577656d6a77513602c8615d58356c8aab30af4267932dbe7892554dc7e0a
ssdeep: 24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aSI2+b+HdiJUC:MTvC/MTQYxsWR7aSI2+b+HoJU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13B45BF027391C062FF9B92734F5AF6115BBC69260123E61F13981DBABE701B1563E7A3
sha3_384: 2914a0d2c4852000f2eaaefc8d4ffab2ab4065c1d4c0e2348588e9b75278ec9bf43dbf46500637a52ab16cabbfdbd0a7
ep_bytes: e86e050000e97afeffff558bec56ff75
timestamp: 2024-02-14 06:02:03

Version Info:
Translation: 0x0809 0x04b0

Trojan:Win32/Phonzy.B!ml also known as:

Lionic	Trojan.Win64.Injects.ts93
FireEye	Generic.mg.d642c925276d2848
Skyhigh	BehavesLike.Win32.Injector.tc
McAfee	Artemis!D642C925276D
Malwarebytes	MachineLearning/Anomalous.97%
Sangfor	Virus.Win32.Save.a
BitDefenderTheta	Gen:NN.ZexaCO.36744.hvW@aSQPmami
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Sophos	Generic ML PUA (PUA)
Jiangmin	Trojan.Script.awbz
Google	Detected
Microsoft	Trojan:Win32/Phonzy.B!ml
Varist	W32/AutoIt.XQ.gen!Eldorado
Cylance	unsafe
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Phonzy.B!ml?

Trojan:Win32/Phonzy.B!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X