Backdoor

Backdoor:Win32/Padodor.SK!MTB (file analysis)

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Sample contains Overlay data
  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Padodor.SK!MTB?



File Info:

name: C33A41B233868C5B20B4.mlw
path: /opt/CAPEv2/storage/binaries/8d952b984cd55f72f7853d29b5ff13cdb3397edffd146e77a87c15ef81861e2e
crc32: C60D2649
md5: c33a41b233868c5b20b4ab7fd8b6f638
sha1: 658c5d3c956b49379bbd55b81b05ffd8fb6c5228
sha256: 8d952b984cd55f72f7853d29b5ff13cdb3397edffd146e77a87c15ef81861e2e
sha512: 2ffae1ce32322b60695f0ba5b818a49f1d9ea8172e9c1928b9b7b11f1cff6eeb4c75144647d1d04fd3501a77a0b275bd68fe39c368855fd029ffcbb065627922
ssdeep: 3072:emYHoABhOFrq2UDz5MSx08uFafmHURHAVgnvedh6DRyU:z6oA6FrqfDz5Me08uF8YU8gnve7GR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T104F3491AFF451BF3E78102723A4BD9C6F72A4478626A94606D5CC01D165FF2C42BE2AF
sha3_384: 57eeb4fae4006d7870c9cd435e8db8f0564544c300b17e81951be38a42c8efb4fe7929d1fdf9e8a69facc8c8966ec997
ep_bytes: 90906090909090b80010400090bb38de
timestamp: 1979-05-15 05:39:38


Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
DrWebBackDoor.Wdozer
MicroWorld-eScanTrojan.GenericKDZ.103285
SkyhighBehavesLike.Win32.Generic.ch
ALYacTrojan.GenericKDZ.103285
MalwarebytesGeneric.Malware.AI.DDS
ZillyaTrojan.Padodor.Win32.970189
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
K7GWTrojan ( 005780dd1 )
K7AntiVirusTrojan ( 005780dd1 )
ArcabitTrojan.Generic.D19375
BitDefenderThetaAI:Packer.9B09EDDD21
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
ESET-NOD32Win32/Padodor.AB
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Trojan.Crypted-32
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderTrojan.GenericKDZ.103285
NANO-AntivirusTrojan.Win32.Padodor.iusqgg
AvastWin32:Padodor-V [Trj]
TencentBackdoor.Win32.Padodor.kp
EmsisoftTrojan.GenericKDZ.103285 (B)
F-SecureTrojan.TR/Dropper.Gen
VIPRETrojan.GenericKDZ.103285
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.c33a41b233868c5b
SophosMal/Padodor-A
SentinelOneStatic AI – Malicious PE
JiangminBackdoor.Padodor.erlj
VaristW32/Backdoor.DKIC-2994
AviraTR/Dropper.Gen
MAXmalware (ai score=80)
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
MicrosoftBackdoor:Win32/Padodor.SK!MTB
ZoneAlarmBackdoor.Win32.Padodor.gen
GDataTrojan.GenericKDZ.103285
GoogleDetected
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
McAfeeTrojan-FVOJ!C33A41B23386
TACHYONBackdoor/W32.Padodor
VBA32Backdoor.Padodor
Cylanceunsafe
PandaTrj/Genetic.gen
RisingRansom.PornoAsset!8.6AA (TFE:2:ZGASfuO0gFH)
IkarusTrojan.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GenKryptik.BJQV!tr
AVGWin32:Padodor-V [Trj]
Cybereasonmalicious.c956b4
DeepInstinctMALICIOUS

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Backdoor

Backdoor:Win32/Padodor.SK!MTB removal instruction

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Sample contains Overlay data
  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Padodor.SK!MTB?



File Info:

name: F27F8674D656031A79E8.mlw
path: /opt/CAPEv2/storage/binaries/59a4cc18f4853a128177c0180fa2288f54cfbbaaf99a3394198636b9cb457304
crc32: 166F9F62
md5: f27f8674d656031a79e8f11f29e63a2f
sha1: 711a60ca6d70e83b80e488d0c83012370b331caf
sha256: 59a4cc18f4853a128177c0180fa2288f54cfbbaaf99a3394198636b9cb457304
sha512: a6a7d950597ddb7b33b47f5b7e160ac3a71269ef39148f4a1b32936adcc6b275ee417e3a72171cfdb806a9fbb5b5fd04d23bb9ec5158e0ef61440c3f70fea0e2
ssdeep: 3072:TwImSVsmLSuijaDGbuSx2JX3PxMeEvPOdgujv6NLPfFFrKP92f65Ha:TzZmutUBx2JX3JML3OdgawrFZKPf9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T198046C5AF2C51F73C790027DFA0B5EDFB72A943A126D96600458803D2367F2852FAAF5
sha3_384: 64bd9382c3385b02cd4f302fab207086250fe668d7082de5d12fac1720d83eae49a1564922ee928e7d87ce9c9c1e6994
ep_bytes: 60909067e80000000090909058909090
timestamp: 1983-06-23 05:39:38


Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
MicroWorld-eScanGen:Trojan.ShellObject.k8Z@aC9JiEk
ClamAVWin.Trojan.Obfus-38
FireEyeGeneric.mg.f27f8674d656031a
SkyhighBehavesLike.Win32.Generic.cm
McAfeeTrojan-FVOK!F27F8674D656
MalwarebytesGeneric.Malware.AI.DDS
VIPREGen:Trojan.ShellObject.k8Z@aC9JiEk
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
K7GWTrojan ( 005780dd1 )
Cybereasonmalicious.a6d70e
ArcabitTrojan.ShellObject.E31BED
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32Win32/Padodor.AB
APEXMalicious
CynetMalicious (score: 100)
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderGen:Trojan.ShellObject.k8Z@aC9JiEk
NANO-AntivirusTrojan.Win32.Padodor.iulbhm
AvastWin32:Padodor-V [Trj]
TencentBackdoor.Win32.Padodor.kp
TACHYONBackdoor/W32.Padodor
SophosMal/Generic-S
F-SecureTrojan.TR/Crypt.XDR.Gen
DrWebBackDoor.Wdozer
Trapminemalicious.high.ml.score
EmsisoftGen:Trojan.ShellObject.k8Z@aC9JiEk (B)
IkarusTrojan.Win32.Padodor
JiangminBackdoor.Padodor.eyfj
GoogleDetected
AviraTR/Crypt.XDR.Gen
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
MicrosoftBackdoor:Win32/Padodor.SK!MTB
ZoneAlarmBackdoor.Win32.Padodor.gen
GDataWin32.Trojan.PSE.855VXQ
VaristW32/Backdoor.DKIC-2994
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
BitDefenderThetaAI:Packer.222A852021
ALYacGen:Trojan.ShellObject.k8Z@aC9JiEk
MAXmalware (ai score=89)
VBA32Backdoor.Padodor
Cylanceunsafe
PandaTrj/Genetic.gen
RisingBackdoor.Berbew!8.115 (TFE:5:QsDMY84vnqT)
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Qukart.A!tr
AVGWin32:Padodor-V [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment