Backdoor

About “Backdoor:Win32/Padodor.SK!MTB” infection

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Sample contains Overlay data
  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Padodor.SK!MTB?


File Info:

name: 520272BA614BEA763F2A.mlw
path: /opt/CAPEv2/storage/binaries/815f22f42ee2ad768313a88b4cff8f0b7d911462445261c7b1e323c6d196497e
crc32: 6E235102
md5: 520272ba614bea763f2a10d983eafc46
sha1: 1cb0aae80e132d46ce45601c5dab4d5c6d32931a
sha256: 815f22f42ee2ad768313a88b4cff8f0b7d911462445261c7b1e323c6d196497e
sha512: 4d9e2d171360a401b7e4a045417ba0bc6b9f305c26f6e08674b5c77e283a86fdb54cd730adfd312cee9ecc8e4667cad572caec52eb2f7bcf691a2ef75e4ba0e7
ssdeep: 24576:CjPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:ibazR0vKLXZ5Tec
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T178458C23FE83A133C4EB61F0027FAE61917ECD359F6140C3099C9AB5B9A56D016793DA
sha3_384: a14038d109b7ac1c2e702299eb467512cf75d6f2009128210d3aaba6522e614abb8c0c67032d923f49f57270afb1e281
ep_bytes: 90909060909067e80000000090909058
timestamp: 2021-11-23 03:39:59

Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
DrWebBackDoor.HangUp.5
MicroWorld-eScanGenPack:Trojan.Agent.DQQO
SkyhighBehavesLike.Win32.Generic.th
ALYacGenPack:Trojan.Agent.DQQO
MalwarebytesGeneric.Malware.AI.DDS
VIPREGenPack:Trojan.Agent.DQQO
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
K7GWTrojan ( 005780dd1 )
Cybereasonmalicious.80e132
ArcabitGenPack:Trojan.Agent.DQQO
BitDefenderThetaAI:Packer.1DE844F721
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32Win32/Padodor.NAM
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Trojan.Crypted-29
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderGenPack:Trojan.Agent.DQQO
NANO-AntivirusTrojan.Win32.Padodor.foufls
AvastWin32:BackdoorX-gen [Trj]
TencentTrojan.Win32.Qukart.ya
TACHYONBackdoor/W32.Padodor
SophosTroj/Padodor-M
F-SecureTrojan.TR/Dropper.Gen
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.520272ba614bea76
EmsisoftGenPack:Trojan.Agent.DQQO (B)
IkarusBackdoor.Win32.Padodor
JiangminBackdoor.Padodor.esac
VaristW32/Pahador.QLFO-8537
AviraTR/Dropper.Gen
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
MicrosoftBackdoor:Win32/Padodor.SK!MTB
ZoneAlarmBackdoor.Win32.Padodor.gen
GDataWin32.Trojan.PSE.15977NU
GoogleDetected
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
McAfeeTrojan-FVOK!520272BA614B
MAXmalware (ai score=85)
VBA32Backdoor.Padodor
Cylanceunsafe
PandaTrj/Genetic.gen
RisingBackdoor.Berbew!1.AF13 (CLASSIC)
YandexBackdoor.Padodor.AF
SentinelOneStatic AI – Malicious PE
FortinetW32/Qukart.A!tr
AVGWin32:BackdoorX-gen [Trj]
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment