Backdoor

Backdoor:Win32/Padodor.SK!MTB (file analysis)

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family
  • Anomalous binary characteristics
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Padodor.SK!MTB?



File Info:

name: 7F25BB76714DC996B876.mlw
path: /opt/CAPEv2/storage/binaries/3e62a8d2cf1d641f255a93aef33ad0ab2b0931e6b98c7215fd2d46ac9c8ba812
crc32: EF1AA632
md5: 7f25bb76714dc996b876af70c8c6fff8
sha1: 64d1b8cacab8e2eb99e17927b939118ef079e9f2
sha256: 3e62a8d2cf1d641f255a93aef33ad0ab2b0931e6b98c7215fd2d46ac9c8ba812
sha512: fc6948bdb334af136f35ecd928d0c1737b20f1b39e1390794483c4235bbeabafaee8eb477336480ef47d1d989166cff87a6c23143f4f70df4a9cad68f60f758e
ssdeep: 1536:qXahW11EBiAmX0GokBmwmOaP6v2vcEv3snCduV9jojTIvjrH:qq3E0RkJmvfv8Cd69jc0vf
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AEA39E66E21C1EA3C7450F32150ED996FE20BB3152A188D71C588FDF3396BB6CD796A0
sha3_384: bfbf76ae95882f2e5ae6d479b5c05bc334f17d81404685f2c686bc10923dcca30fa574d268d9d7a6f660770ceba58bad
ep_bytes: 90909067e80000000090905890909005
timestamp: 1986-03-19 05:39:38


Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Trojan.ShellObject.g8W@aaajMem
ClamAVWin.Trojan.Obfus-38
SkyhighBehavesLike.Win32.Generic.nh
McAfeeGenericRXPE-AP!410D28D1D701
MalwarebytesGeneric.Malware.AI.DDS
ZillyaTrojan.PadodorGen.Win32.15
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
K7GWTrojan ( 005780dd1 )
CrowdStrikewin/malicious_confidence_100% (D)
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Padodor.AB
APEXMalicious
CynetMalicious (score: 100)
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderGen:Trojan.ShellObject.g8W@aaajMem
NANO-AntivirusTrojan.Win32.Padodor.jvzvpk
AvastWin32:Padodor-V [Trj]
TencentBackdoor.Win32.Padodor.kp
TACHYONBackdoor/W32.Padodor
EmsisoftGen:Trojan.ShellObject.g8W@aaajMem (B)
F-SecureTrojan.TR/Crypt.XDR.Gen
DrWebBackDoor.Wdozer
VIPREGen:Trojan.ShellObject.g8W@aaajMem
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.7f25bb76714dc996
SentinelOneStatic AI – Malicious PE
GDataGen:Trojan.ShellObject.g8W@aaajMem
JiangminTrojanSpy.Convagent.fp
GoogleDetected
AviraTR/Crypt.XDR.Gen
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
ArcabitTrojan.ShellObject.E87CBE
ZoneAlarmBackdoor.Win32.Padodor.gen
MicrosoftBackdoor:Win32/Padodor.SK!MTB
VaristW32/Backdoor.DKIC-2994
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
BitDefenderThetaAI:Packer.6CB2E9D01E
ALYacGen:Trojan.ShellObject.g8W@aaajMem
MAXmalware (ai score=84)
VBA32Backdoor.Padodor
Cylanceunsafe
PandaTrj/Genetic.gen
RisingBackdoor.Padodor!8.118 (TFE:5:ostuCj5goYJ)
IkarusBackdoor.Win32.Padodor
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Agent.B077!tr
AVGWin32:Padodor-V [Trj]
DeepInstinctMALICIOUS

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Backdoor

Backdoor:Win32/Padodor.SK!MTB information

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Sample contains Overlay data
  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Padodor.SK!MTB?



File Info:

name: 7C79A929312ED572CB11.mlw
path: /opt/CAPEv2/storage/binaries/8fa35ce790e500b5f8f270e81532b4e4fc2ee872d55c9eccaac13a3321172ed3
crc32: 2E7D50F7
md5: 7c79a929312ed572cb11b6251f375319
sha1: 79bd6439f407edb63f1006a40a9ac149f6b5ab69
sha256: 8fa35ce790e500b5f8f270e81532b4e4fc2ee872d55c9eccaac13a3321172ed3
sha512: fceab0921645f82d8694bd48de64059892f5bdccd7f67c2e517b070e2a4ba994c577a1b711c05185a95e426859fa9bc980ad4a3e0f072c4b52cacb6fd7216dde
ssdeep: 12288:sTRZJGvc6VVwByIwcMpV6yYP4rbpV6yYPg058KS:CZJucIwByIwcMW4XWleKS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F0949C2214971E61E863E1FC3F264E1B5AE6CC212FE9DCE460FAC0DE85BAF54C169075
sha3_384: 0620963b78974cb66f28cc0c89d9e015c8cb02a4a341767b6a67077e72ebf88d169cd961067f0aff494d4fd9ad7a3599
ep_bytes: 909090b80010400090bbd0c7400090b9
timestamp: 2017-10-15 03:39:59


Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Padodor.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Trojan.ShellObject.z8Z@aO1tmfb
ClamAVWin.Dropper.Berbew-10009643-0
FireEyeGeneric.mg.7c79a929312ed572
CAT-QuickHealWorm.Dorkbot.A
SkyhighBehavesLike.Win32.Generic.gc
McAfeeArtemis!7C79A929312E
Cylanceunsafe
VIPREGen:Trojan.ShellObject.z8Z@aO1tmfb
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaBackdoor:Win32/Padodor.685a79cb
K7GWTrojan ( 005780dd1 )
K7AntiVirusTrojan ( 005780dd1 )
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Padodor.NAM
APEXMalicious
CynetMalicious (score: 100)
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderGen:Trojan.ShellObject.z8Z@aO1tmfb
NANO-AntivirusTrojan.Win32.Padodor.foufls
AvastWin32:BackdoorX-gen [Trj]
TencentBackdoor.Win32.Padodor.kg
SophosTroj/Padodor-M
F-SecureTrojan.TR/Crypt.XDR.Gen
DrWebBackDoor.HangUp.5
ZillyaTrojan.PadodorGen.Win32.7
Trapminemalicious.high.ml.score
EmsisoftGen:Trojan.ShellObject.z8Z@aO1tmfb (B)
IkarusTrojan.Crypt
GDataWin32.Trojan.PSE.1G33IXO
JiangminBackdoor.Padodor.eykm
GoogleDetected
AviraTR/Crypt.XDR.Gen
MAXmalware (ai score=88)
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
ArcabitTrojan.ShellObject.E320DF
ZoneAlarmBackdoor.Win32.Padodor.gen
MicrosoftBackdoor:Win32/Padodor.SK!MTB
VaristW32/Pahador.QLFO-8537
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
BitDefenderThetaAI:Packer.595D5A1521
ALYacGen:Trojan.ShellObject.z8Z@aO1tmfb
TACHYONBackdoor/W32.Padodor
VBA32Backdoor.Padodor
MalwarebytesGeneric.Malware.AI.DDS
PandaTrj/Genetic.gen
RisingBackdoor.Berbew!1.AF13 (CLASSIC)
YandexBackdoor.Padodor.AF
SentinelOneStatic AI – Malicious PE
FortinetW32/GenKryptik.FBNK!tr
AVGWin32:BackdoorX-gen [Trj]
DeepInstinctMALICIOUS

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment