Trojan:Win32/Phonzy.B!ml malicious file

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Phonzy.B!ml?


File Info:
name: 690254B2B75A4F4CBE2A.mlw
path: /opt/CAPEv2/storage/binaries/0ec9c5b42e0040e310d5c2a17ece4e61674c177a61550c1716e2d3fe7cc19af6
crc32: B56B487F
md5: 690254b2b75a4f4cbe2a6c49dbb110f5
sha1: 856bfb273455fe3917b6193ff6a72b2a7106cdf3
sha256: 0ec9c5b42e0040e310d5c2a17ece4e61674c177a61550c1716e2d3fe7cc19af6
sha512: 16f0c696e939eb08f80d3e7cb11bc9b2fdc801eca373ad22d5ad658336b80fed4a049a5c11201cacface0674770b64d453a834afed287ac9757dc88bf3454e96
ssdeep: 24576:7FQeYL+KKEPS1bvKE28jaP0Nz/fWZLoJ8GF:7FQWKKEP2biE28ja0OZLkF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16D25C011F5D28073C6E232B1CE7EF76A963DF53B0327D2DB27C81D255E945426A2A322
sha3_384: 307e9e2cc3ccd042190f559a0f01897efc854ac9ca9f7c29ca0d63345e74230234cd51deba9adac7efce7571857db096
ep_bytes: ceffff595dc3833800568bf2741c570f
timestamp: 2012-04-10 00:11:21

Version Info:
0: [No Data]

Trojan:Win32/Phonzy.B!ml also known as:

Bkav	W32.AIDetectMalware
Skyhigh	BehavesLike.Win32.Generic.fh
Malwarebytes	Malware.AI.3737919778
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Dropper.DarkKomet-9986221-0
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.690254b2b75a4f4c
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Suspicious PE
Antiy-AVL	Trojan/Script.Phonzy
Microsoft	Trojan:Win32/Phonzy.B!ml
Google	Detected
Cylance	unsafe
Rising	Trojan.Generic@AI.100 (RDML:+ANxmL2T0P2X7EdNZ1mz7w)
BitDefenderTheta	Gen:NN.ZexaF.36792.!qZ@a4srjZn
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Trojan:Win32/Phonzy.B!ml?

Trojan:Win32/Phonzy.B!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X