Trojan:Win32/Phonzy.B!ml (file analysis)

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Phonzy.B!ml?


File Info:
name: 8B0AF012273BB43FC377.mlw
path: /opt/CAPEv2/storage/binaries/89dc4128d67642fa5d5f377a4b29a78d00e1b096a3472ed3ae9b2bbed2105a49
crc32: 26C61175
md5: 8b0af012273bb43fc3776a829a320aec
sha1: 796583e4e3fd18e65f6055edcea1b25dd8a2a9db
sha256: 89dc4128d67642fa5d5f377a4b29a78d00e1b096a3472ed3ae9b2bbed2105a49
sha512: 1e283aff3528ab61813e7dc0305fe1ff2a451f61f8d7e7b7995627059c1044d8aad3f10b9403184c50b9b1fd68f6e63e5a13dacbbd2af00f18e929ace57b8275
ssdeep: 768:SFIGZzFEtlmWCIRv0ZaZRbPP3lLuzZPKq/pfJ+cxG8M+gcR5:SFIGZimCh0YlPP3lLuBZ/NYcU8M+P
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T18B33F748BE158CFBE641637EC4EBC37B5A7CF5418B234B53BB70BA346B13291259424A
sha3_384: 52e2aa037047120017bbc6f80cf6fade416bfc24db8bb689b1322a05bbd358d78d8ced965679dfef3628205f7df88331
ep_bytes: 83ec1cc7042401000000ff1540924000
timestamp: 2024-02-27 02:47:58

Version Info:
0: [No Data]

Trojan:Win32/Phonzy.B!ml also known as:

Bkav	W32.Common.007F341B
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Gen:Variant.Fragtor.513485
Skyhigh	BehavesLike.Win32.Generic.qm
McAfee	Artemis!8B0AF012273B
Malwarebytes	Trojan.ShellCode
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Injector.1150c89a
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.ETQB
Cynet	Malicious (score: 100)
BitDefender	Gen:Variant.Fragtor.513485
Emsisoft	Gen:Variant.Fragtor.513485 (B)
F-Secure	Trojan.TR/Injector.femid
VIPRE	Gen:Variant.Fragtor.513485
FireEye	Generic.mg.8b0af012273bb43f
Ikarus	Trojan.Win32.Agent
GData	Win32.Trojan.PSE.13I1X2L
Jiangmin	Trojan.Generic.bjgvg
Google	Detected
Avira	TR/Injector.femid
Antiy-AVL	Trojan/Win32.Phonzy
Kingsoft	malware.kb.a.831
Arcabit	Trojan.Fragtor.D7D5CD
Microsoft	Trojan:Win32/Phonzy.B!ml
Varist	W32/Kryptik.LIO.gen!Eldorado
BitDefenderTheta	Gen:NN.ZexaF.36744.d0Y@ai6cABf
ALYac	Gen:Variant.Fragtor.513485
MAX	malware (ai score=86)
Cylance	unsafe
Panda	Trj/Chgt.AD
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Injector.ETQB!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:Win32/Phonzy.B!ml?

Trojan:Win32/Phonzy.B!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X