Backdoor

Should I remove “Backdoor:Win32/Padodor.SK!MTB”?

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Sample contains Overlay data
  • Creates an indicator observed in Territorial Disputes report SIG40
  • Uses Windows utilities for basic functionality
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Padodor.SK!MTB?



File Info:

name: B8CCF7C0C22224D37700.mlw
path: /opt/CAPEv2/storage/binaries/a85369fbcbf4767822f7276c603c24504ea3563aa4f4bbeec8a26b308f50c4f6
crc32: 9F46CA1F
md5: b8ccf7c0c22224d377009471dd73b316
sha1: fe72f72733543aae970e0afcff14d44dce4395ee
sha256: a85369fbcbf4767822f7276c603c24504ea3563aa4f4bbeec8a26b308f50c4f6
sha512: 2ae013797ee57876b22cf8c5abbe45e8e74ac240990925d4cdd126e132c3d5a3169c213446015018000ac5a4165ab5fd60d68908923ba42a889748547c835793
ssdeep: 3072:zP+qFfjUYmDO+HPLdFaPiz3gb3a3+X13XRz:zVqYmDO+jdtzw7aOl3Bz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13CA38E2AF1560F32D7D10EF42ACEA2B7BE39EC7A419DD9221A10C1493266E1D177B770
sha3_384: 3235902e9a4bfa2160b90a720a61cee93b779cb4204b8d7e5e045fef9580fd29e0e9457e4463f2b976b6c67f1f126232
ep_bytes: 9090b80010400090bb38de4000b97876
timestamp: 1970-01-01 00:00:00


Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

CyrenCloudW32/Agent.FTJ.gen!Eldorado
BkavW32.AIDetectMalware
LionicTrojan.Win32.Padodor.m!c
tehtrisGeneric.Malware
MicroWorld-eScanGen:Trojan.ShellObject.g8X@aK5!lZo
FireEyeGeneric.mg.b8ccf7c0c22224d3
SkyhighBehavesLike.Win32.Generic.ch
McAfeeArtemis!B8CCF7C0C222
Cylanceunsafe
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
AlibabaBackdoor:Win32/Padodor.238d28fc
K7GWTrojan ( 005780dd1 )
CrowdStrikewin/malicious_confidence_100% (D)
ArcabitTrojan.ShellObject.E25A82
BitDefenderThetaAI:Packer.51196B2721
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32Win32/Padodor.AB
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Dropper.Berbew-10009643-0
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderGen:Trojan.ShellObject.g8X@aK5!lZo
NANO-AntivirusTrojan.Win32.Padodor.jwagtz
AvastWin32:Padodor-V [Trj]
TencentBackdoor.Win32.Padodor.kp
Ad-AwareGen:Trojan.ShellObject.g8X@aK5!lZo
TACHYONBackdoor/W32.Padodor
EmsisoftGen:Trojan.ShellObject.g8X@aK5!lZo (B)
F-SecureTrojan.TR/Dropper.Gen
DrWebBackDoor.Wdozer
VIPREGen:Trojan.ShellObject.g8X@aK5!lZo
Trapminemalicious.high.ml.score
SophosML/PE-A
IkarusTrojan.Crypt
JiangminBackdoor.Padodor.exys
VaristW32/Backdoor.DKIC-2994
AviraTR/Dropper.Gen
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
MicrosoftBackdoor:Win32/Padodor.SK!MTB
ZoneAlarmBackdoor.Win32.Padodor.gen
GDataWin32.Trojan.PSE.15MS2TX
GoogleDetected
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
ALYacGen:Trojan.ShellObject.g8X@aK5!lZo
MAXmalware (ai score=85)
VBA32Backdoor.Padodor
MalwarebytesGeneric.Malware.AI.DDS
PandaTrj/Genetic.gen
RisingBackdoor.Padodor!8.118 (TFE:5:7KxSiWwgENI)
SentinelOneStatic AI – Malicious PE
FortinetW32/Agent.B077!tr
AVGWin32:Padodor-V [Trj]
Cybereasonmalicious.733543
DeepInstinctMALICIOUS

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Backdoor

Backdoor:Win32/Padodor.SK!MTB removal tips

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Sample contains Overlay data
  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Padodor.SK!MTB?



File Info:

name: DAD5986D7286F5E28408.mlw
path: /opt/CAPEv2/storage/binaries/aa2c9ae101cfce78737e1800726b4ec383b5db262b03735167b601e3f5e21ffe
crc32: 22DFB2A5
md5: dad5986d7286f5e284083344e8cb0548
sha1: e6ae97c4a24f910a958b8e28b0178b090d2dd3e6
sha256: aa2c9ae101cfce78737e1800726b4ec383b5db262b03735167b601e3f5e21ffe
sha512: a4a20d6527a29a90949ac983532a4d5c515e1dc7b4ff2fe7814540202ddbb3ec58f8acecdc19c62317d6fadc9b77ca63052a3bfea8a6dbd50c7c59efc2b7ef68
ssdeep: 3072:633x1d7s1PTjkLejSJdEN0s4WE+3S9pui6yYPaI7DX:ip7sd/GENm+3Mpui6yYPaI/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F6D3AE47E62B6F79CC9D15FC35C668F49F58D02461398C9026BE819C13EBEEA43762C8
sha3_384: 40023acd5759bb0a3c5288de2d16c3b8c8e589183a599b79920f72de030dd7980754faddd9fb3e0314b74126fcc8d3de
ep_bytes: 90909090906067e80000000090909090
timestamp: 2017-10-15 03:39:59


Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
DrWebBackDoor.HangUp.5
MicroWorld-eScanGen:Trojan.ShellObject.i8Z@aGN6KMb
ClamAVWin.Trojan.Crypted-31
FireEyeGeneric.mg.dad5986d7286f5e2
SkyhighBehavesLike.Win32.Generic.cc
McAfeeGenericRXHD-SL!0E088F4798AC
MalwarebytesGeneric.Malware.AI.DDS
VIPREGen:Trojan.ShellObject.i8Z@aGN6KMb
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
K7GWTrojan ( 005780dd1 )
Cybereasonmalicious.4a24f9
ArcabitTrojan.ShellObject.E01D67
BitDefenderThetaAI:Packer.E277728A21
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32Win32/Padodor.NAM
APEXMalicious
CynetMalicious (score: 100)
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderGen:Trojan.ShellObject.i8Z@aGN6KMb
NANO-AntivirusTrojan.Win32.Padodor.floext
AvastWin32:BackdoorX-gen [Trj]
TencentBackdoor.Win32.Padodor.kg
EmsisoftGen:Trojan.ShellObject.i8Z@aGN6KMb (B)
F-SecureTrojan.TR/Dropper.Gen
Trapminemalicious.high.ml.score
SophosTroj/Padodor-M
SentinelOneStatic AI – Malicious PE
JiangminBackdoor.Padodor.bmdd
GoogleDetected
AviraTR/Dropper.Gen
MAXmalware (ai score=85)
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
MicrosoftBackdoor:Win32/Padodor.SK!MTB
ZoneAlarmBackdoor.Win32.Padodor.gen
GDataWin32.Trojan.PSE.1G33IXO
VaristW32/Pahador.QLFO-8537
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
ALYacGen:Trojan.ShellObject.i8Z@aGN6KMb
TACHYONBackdoor/W32.Padodor
VBA32Backdoor.Padodor
Cylanceunsafe
PandaTrj/Genetic.gen
RisingBackdoor.Berbew!1.AF13 (CLASSIC)
YandexBackdoor.Padodor.AF
IkarusTrojan-Downloader.Win32.Berbew
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Qukart.A!tr
AVGWin32:BackdoorX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment