Should I remove “Trojan:Win32/Phonzy.B!ml”?

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Phonzy.B!ml?


File Info:
name: 6606B1F9E9E76B5CB150.mlw
path: /opt/CAPEv2/storage/binaries/31fafb4e4520562a62be59a2b024a07956a1fc5278e31bbef5315243b31e4a57
crc32: 4FB3FE82
md5: 6606b1f9e9e76b5cb150ecb43dc5a6c1
sha1: 12b3880515117136c9bb24d9ec311fe33e6d0329
sha256: 31fafb4e4520562a62be59a2b024a07956a1fc5278e31bbef5315243b31e4a57
sha512: f1b8baf47202001c06b401d23fe41f937a26307bcd626614a2d557ede30fb57fb3035c229ddc7d45264e0d0f4b32b06831ffc2da3675b03c556decd469bab7d0
ssdeep: 3072:nIyRF9ESWu0SWuDmSXrw3Mtr0sxMKlLEKuN:nIyFESWu0SWu2sRL2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FED36C268980B057E79503B4949379AC6CF4FC2EBEE9CCF2B641C515ACB1C3A5663387
sha3_384: d07724d4bd01c95fa00d41547dc6a414c5bdcbf8cf3f375ce6bc022ecc3cf9ca467bd632a04499d207b0d74086195b01
ep_bytes: 
timestamp: 2014-04-29 18:27:40

Version Info:
0: [No Data]

Trojan:Win32/Phonzy.B!ml also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
ClamAV	Win.Malware.Shodi-10014025-0
Skyhigh	BehavesLike.Win32.Generic.cm
McAfee	GenericRXTK-BY!6606B1F9E9E7
Sangfor	Suspicious.Win32.Save.a
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
Avast	Win64:Evo-gen [Trj]
Rising	Trojan.Generic@AI.100 (RDML:vHeKBh8/nYF+jCdjyPx/WQ)
Ikarus	Trojan.Crypt
Google	Detected
Antiy-AVL	Virus/Win64.Shohdi.a
Kingsoft	malware.kb.b.861
Xcitium	Heur.Corrupt.PE@1z141z3
Microsoft	Trojan:Win32/Phonzy.B!ml
Varist	W32/S-5a8d2096!Eldorado
Malwarebytes	Malware.AI.1838386179
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Shohdi.6145!tr
AVG	Win64:Evo-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Phonzy.B!ml?

Trojan:Win32/Phonzy.B!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X