Backdoor

How to remove “Backdoor:Win32/Padodor.SK!MTB”?

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Padodor.SK!MTB?



File Info:

name: BE23E8C090E381BFA444.mlw
path: /opt/CAPEv2/storage/binaries/951c3e5d67442de55c966d8388504c86930fd3541bbbc3d5bc26867bd56b9d3a
crc32: F0F235CC
md5: be23e8c090e381bfa44489e6eeb1f03a
sha1: 4033ea4c35ed2c49c16a2456fcd14add75d2f690
sha256: 951c3e5d67442de55c966d8388504c86930fd3541bbbc3d5bc26867bd56b9d3a
sha512: 133da6893b7a603b3bd00c7cdd06dcbda3de28c1cbab58f1c6c507339ccc03ac9bc34129e0dcbc6806c699e3ec9dd57839d1a6043fe304a7f2088eb5ad2528d9
ssdeep: 1536:83vQRzLyDy2wGug9a8lNBjPB/LMInV4VS0jBrVRQpR+KRFR3RzR1URJrCiuiNj51:83v4O22wVg9a8TjPBzMIniVSMepjb5Zw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BF936C4C528E4F13ECC416B67E4BF3A6B2D4B476C618D8B6642DC04E3E37EE811A9671
sha3_384: e19d41b33c2f5f70c99389712e510fae3f9f1dab0990a8108da70dc8287ef4889e268b18c77dcd92a7f00182b546fd6c
ep_bytes: 90909090906067e80000000090909090
timestamp: 2020-07-11 03:39:59


Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanGenPack:Trojan.Agent.DQQO
FireEyeGeneric.mg.be23e8c090e381bf
SkyhighBehavesLike.Win32.Generic.mc
ALYacGenPack:Trojan.Agent.DQQO
MalwarebytesPadodor.Backdoor.Bot.DDS
VIPREGenPack:Trojan.Agent.DQQO
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
K7GWTrojan ( 005780dd1 )
Cybereasonmalicious.c35ed2
ArcabitGenPack:Trojan.Agent.DQQO
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
ESET-NOD32Win32/Padodor.NAM
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Trojan.Crypted-31
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderGenPack:Trojan.Agent.DQQO
NANO-AntivirusTrojan.Win32.Padodor.flxpjc
AvastWin32:BackdoorX-gen [Trj]
TencentBackdoor.Win32.Padodor.kp
EmsisoftGenPack:Trojan.Agent.DQQO (B)
F-SecureTrojan.TR/Crypt.ZPACK.Gen2
DrWebBackDoor.HangUp.5
ZillyaTrojan.Padodor.Win32.723879
Trapminemalicious.high.ml.score
SophosTroj/Padodor-M
SentinelOneStatic AI – Malicious PE
JiangminBackdoor.Padodor.qfs
VaristW32/Pahador.QLFO-8537
AviraTR/Crypt.ZPACK.Gen2
MAXmalware (ai score=89)
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
MicrosoftBackdoor:Win32/Padodor.SK!MTB
ZoneAlarmBackdoor.Win32.Padodor.gen
GDataGenPack:Trojan.Agent.DQQO
GoogleDetected
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
McAfeeGenericRXHD-SL!04C2850A19CB
TACHYONBackdoor/W32.Padodor
VBA32Backdoor.Padodor
Cylanceunsafe
PandaTrj/Genetic.gen
RisingBackdoor.Berbew!1.AF13 (CLASSIC)
YandexBackdoor.Padodor.AF
IkarusBackdoor.Win32.Padodor
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Qukart.A!tr
BitDefenderThetaAI:Packer.B245410121
AVGWin32:BackdoorX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Backdoor

Backdoor:Win32/Padodor.SK!MTB removal guide

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Padodor.SK!MTB?



File Info:

name: C467695B378A98557EC9.mlw
path: /opt/CAPEv2/storage/binaries/b31b11bbb589138f0347ef0edc1f871c309c0ec49310811f4ec10d8f05a51504
crc32: FD5EC576
md5: c467695b378a98557ec9a449bcd42bd6
sha1: 46d6f4642a1797666211c8d0d8026010dc2b179e
sha256: b31b11bbb589138f0347ef0edc1f871c309c0ec49310811f4ec10d8f05a51504
sha512: ea2451160d43a489b077ce08d496c7f3e92e2ada26f8a4ad1b50dcfe9587c4fd9d779a22fa6f36b47b38b4a5ba75fac4938770ce4a751d5fcb5fce7766a0ea43
ssdeep: 3072:6ORaIlnNIcH7TxDFic31WdTCn93OGey/ZhJakrPF:3RFNIcbd0cITCndOGeKTaG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T137C35C1BB35D0B31CE4D33B7350E8AC37B2A817A53AE959C24A8D0CCD253E78127A5B5
sha3_384: 46689e9c25090d3c495a0438a29178f2a55b73d287de4830d33dd350a0e6d91c8d3134c31e33c26a134e6472a3619b1e
ep_bytes: 609090909090b8001040009090bb38de
timestamp: 1993-01-21 05:39:38


Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
DrWebBackDoor.Wdozer
MicroWorld-eScanTrojan.GenericKDZ.103285
FireEyeGeneric.mg.c467695b378a9855
SkyhighBehavesLike.Win32.Malware.ch
McAfeeTrojan-FVOJ!C467695B378A
MalwarebytesGeneric.Malware.AI.DDS
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
K7GWTrojan ( 005780dd1 )
CrowdStrikewin/malicious_confidence_100% (D)
ArcabitTrojan.Generic.D19375
BitDefenderThetaAI:Packer.780C268C21
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32Win32/Padodor.AB
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Trojan.Crypted-28
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderTrojan.GenericKDZ.103285
AvastWin32:Padodor-V [Trj]
TencentBackdoor.Win32.Padodor.kp
EmsisoftTrojan.GenericKDZ.103285 (B)
F-SecureTrojan.TR/Crypt.ZPACK.Gen2
VIPRETrojan.GenericKDZ.103285
Trapminemalicious.high.ml.score
SophosMal/Padodor-A
SentinelOneStatic AI – Malicious PE
JiangminBackdoor.Padodor.erlx
VaristW32/Backdoor.DKIC-2994
AviraTR/Crypt.ZPACK.Gen2
MAXmalware (ai score=82)
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
MicrosoftBackdoor:Win32/Padodor.SK!MTB
ZoneAlarmBackdoor.Win32.Padodor.gen
GDataWin32.Trojan.PSE.15MS2TX
GoogleDetected
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
VBA32Backdoor.Padodor
ALYacTrojan.GenericKDZ.103285
TACHYONBackdoor/W32.Padodor
Cylanceunsafe
PandaTrj/Genetic.gen
RisingRansom.PornoAsset!8.6AA (TFE:2:dQq3nsYFyrD)
IkarusTrojan.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Qukart.A!tr
AVGWin32:Padodor-V [Trj]
Cybereasonmalicious.42a179
DeepInstinctMALICIOUS

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment