Backdoor

About “Backdoor:Win32/Padodor.SK!MTB” infection

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Sample contains Overlay data
  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Padodor.SK!MTB?


File Info:

name: 018D95B5B1E3D69B0BC8.mlw
path: /opt/CAPEv2/storage/binaries/75eb61907a516529d61c6364c12847eb9004efbbd78edb35ff3eda1be6096de5
crc32: 7CB6B1BD
md5: 018d95b5b1e3d69b0bc8ea8fe8159199
sha1: c95a4c2a59237ed60fcd8123fbe471fae84826f3
sha256: 75eb61907a516529d61c6364c12847eb9004efbbd78edb35ff3eda1be6096de5
sha512: 13d34cf7296fcdf9b7f9fc7765ad4b563070389e6a107ed6c417aebb08d0a0babf615cb6e9c7c52020f2146e1353cf026c8e289a2ae8c9843f53286f544473e1
ssdeep: 3072:u1T83Zsv2vL0lZGPxMeEvPOdgujv6NLPfFFrKP92f65Ha:j3ZsOvglZGJML3OdgawrFZKPf9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16D046C1ABF000F71C6B702722A06E4E6A71D907C527586A35D68C15E131AE2BF77B6CF
sha3_384: b719c78be926436feee9c6cd1b5e6e171e63902f48a5d9d8edf12f24d08e393b0f423924be7bae42f55b51edd3eac699
ep_bytes: 90609090909090b800104000bb38de40
timestamp: 1983-06-23 05:39:38

Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
MicroWorld-eScanTrojan.GenericKDZ.103285
ClamAVWin.Trojan.Crypted-30
FireEyeGeneric.mg.018d95b5b1e3d69b
SkyhighBehavesLike.Win32.Generic.cm
ALYacTrojan.GenericKDZ.103285
MalwarebytesGeneric.Malware.AI.DDS
VIPRETrojan.GenericKDZ.103285
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
K7GWTrojan ( 005780dd1 )
ArcabitTrojan.Generic.D19375
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32Win32/Padodor.AB
APEXMalicious
CynetMalicious (score: 100)
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderTrojan.GenericKDZ.103285
NANO-AntivirusTrojan.Win32.Padodor.kbvxos
AvastWin32:Padodor-V [Trj]
TencentBackdoor.Win32.Padodor.kp
EmsisoftTrojan.GenericKDZ.103285 (B)
F-SecureTrojan.TR/Crypt.XDR.Gen
DrWebBackDoor.Wdozer
ZillyaTrojan.Padodor.Win32.1307641
Trapminemalicious.high.ml.score
SophosMal/Padodor-A
SentinelOneStatic AI – Malicious PE
JiangminBackdoor.Padodor.erlj
AviraTR/Crypt.XDR.Gen
MAXmalware (ai score=88)
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
MicrosoftBackdoor:Win32/Padodor.SK!MTB
ZoneAlarmBackdoor.Win32.Padodor.gen
GDataWin32.Trojan.PSE.855VXQ
GoogleDetected
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
McAfeeTrojan-FVOJ!018D95B5B1E3
TACHYONBackdoor/W32.Padodor
VBA32Backdoor.Padodor
Cylanceunsafe
RisingRansom.PornoAsset!8.6AA (TFE:2:1QjD8ksFU9R)
IkarusTrojan.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Qukart.A!tr
BitDefenderThetaAI:Packer.F56D81FC21
AVGWin32:Padodor-V [Trj]
PandaTrj/Genetic.gen

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment