Trojan:Win32/Phonzy.B!ml (file analysis)

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Phonzy.B!ml?


File Info:
name: F84246D9A419CAF8B5E0.mlw
path: /opt/CAPEv2/storage/binaries/2ec55c64f3c6d65e61a593abcc7342dffb104ca2cd992992e3381df0818defa4
crc32: 1FD1A22E
md5: f84246d9a419caf8b5e00f2f26fce2ce
sha1: ab1b221bcf76ef0c83d62dfd4a56abc1ac06d1c6
sha256: 2ec55c64f3c6d65e61a593abcc7342dffb104ca2cd992992e3381df0818defa4
sha512: ea81c3a6138ac0e936544acfa728c35358df6494eac7c6fd79186ae8bfcde393916dfb4a32d25d587f38ea4825fc0c7f5d3ab04cbca20510a3e441595a9cb5c2
ssdeep: 12288:4lHk+fOKVHGc30+DXTKt2IICbMujkicygo3I2OkPO:4lOKVz0+zG4IB1/j3ZOkPO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19A952304739944B9D11B1B30CEAEFA21DB3DFCD40532595B1B886F8BE97C9D365222A3
sha3_384: 2cc20530c638139a95ae38db9bf5985c36d3c7301f21cfdb9bf42775e1f740e752046ab7f52fdf04b590af9631d01d94
ep_bytes: ffff8bc65e5dc20400558bec5156578b
timestamp: 2006-10-27 03:42:35

Version Info:
0: [No Data]

Trojan:Win32/Phonzy.B!ml also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Expiro.4!c
MicroWorld-eScan	Win32.Expiro.Gen.7
FireEye	Generic.mg.f84246d9a419caf8
Skyhigh	Artemis!Virus
Cylance	unsafe
Zillya	Trojan.Expiro.Win32.1571
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
Arcabit	Win32.Expiro.Gen.7
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
BitDefender	Win32.Expiro.Gen.7
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Tencent	Virus.Win32.VirMoiva.a
Ad-Aware	Win32.Expiro.Gen.7
Sophos	W32/Moiva-A
VIPRE	Win32.Expiro.Gen.7
Emsisoft	Win32.Expiro.Gen.7 (B)
Ikarus	Expiro.Win32
Google	Detected
Antiy-AVL	Trojan/Win32.Sabsik
Microsoft	Trojan:Win32/Phonzy.B!ml
GData	Win32.Expiro.Gen.7
Cynet	Malicious (score: 100)
ALYac	Win32.Expiro.Gen.7
MAX	malware (ai score=83)
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TROJ_GEN.R03BH09LO23
Rising	Trojan.Generic@AI.100 (RDML:9sSGIRcAkJzmcu4vB6hllw)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Expiro.NDP!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Trojan:Win32/Phonzy.B!ml?

Trojan:Win32/Phonzy.B!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X