What is “Trojan:Win32/Phonzy.B!ml”?

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Deletes executed files from disk

How to determine Trojan:Win32/Phonzy.B!ml?

File Info:
name: 44E4C6D3027A2AA362CA.mlw
path: /opt/CAPEv2/storage/binaries/1a77e103489cc118ab4bad9a743d9ee36012c7f44ff4436fa488a9538d603c9f
crc32: 9BE59874
md5: 44e4c6d3027a2aa362ca114f1dece74a
sha1: 9e14917782009c515cb68762a1984f2451dd17d6
sha256: 1a77e103489cc118ab4bad9a743d9ee36012c7f44ff4436fa488a9538d603c9f
sha512: d11dd2be9047c3dab5e27f2e08105c03007995f33a3a52a09740f8d8e788779c7612e8de4bb827a00d302a836d5d80910a1828af88955f3f5d61a30823f152b2
ssdeep: 196608:azhEpp+T5jsgBF9Pzz6bm+6mEfaU16CN9jVe0orK9ZFft9ltMZFGFJ8mnfEPXMOi:azhjtF9zo67vFF9l4FGYIfEPhCWNE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F4E6333FB668953ED5A60F314A72D360887BBA24B85A8C1B07F0491DDF625701E3F71A
sha3_384: 64f5fd2e5f6bb7a0d8863e9dd706e0335c387020086c1b53a3484888223b410f6bf974f4f0bb61f0cd1bc8408312291a
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2020-11-15 09:48:30

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: Far Setup (r2402181200)                                     
FileVersion: 3.0.5665            
LegalCopyright:                                                                                                     
OriginalFileName:                                                   
ProductName: Far                                                         
ProductVersion: 3.0.5665                                          
Translation: 0x0000 0x04b0

Trojan:Win32/Phonzy.B!ml also known as:

How to remove Trojan:Win32/Phonzy.B!ml?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.