Backdoor

Backdoor:Win32/Padodor.SK!MTB removal instruction

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Sample contains Overlay data
  • Creates an indicator observed in Territorial Disputes report SIG40
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Padodor.SK!MTB?


File Info:

name: 99E3CF4D0E7598968F6C.mlw
path: /opt/CAPEv2/storage/binaries/227926be7fd2a287e7497a5c9dc356353c132cd71a6218134be981c8b42be224
crc32: A58C75AF
md5: 99e3cf4d0e7598968f6cfa88e4904a6d
sha1: a049209bd2932fa7cdc8ac7319812e64b0e4d629
sha256: 227926be7fd2a287e7497a5c9dc356353c132cd71a6218134be981c8b42be224
sha512: 2fdfb993c76f61107a4cc612ec1e563b64dbbb143d40e92749a52c9b9c5b0bee62bb01a1027547e3be91b5b1d25f21ab7e1eadc0136f8deb16cb418f35146ca7
ssdeep: 3072:hYZ7SVWeddt5Ugkiel203H/6TC+qF1SsB1bw4AVRrd9:hESVWed5Ugk5l9C81NBy9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16CC3BF6F53792F5EC788C734121E41AE7218E63D87FAD2C0E2BCC48E65766AC11FA944
sha3_384: 5a4c6e6e424f1a042bf115ca8da95a26d306fb25a2308275f5d75e0afc18f013187cf2081def18dba916aa02fb2a3a1e
ep_bytes: 909067e800000000909090909058059f
timestamp: 2023-04-07 03:39:59

Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
DrWebBackDoor.HangUp.5
MicroWorld-eScanGen:Trojan.ShellObject.h0Y@aGjJTmg
ClamAVWin.Trojan.Berbew-10013977-0
FireEyeGeneric.mg.99e3cf4d0e759896
SkyhighBehavesLike.Win32.Backdoor.cc
McAfeeGeneric Malware.bj
MalwarebytesPadodor.Backdoor.Bot.DDS
ZillyaTrojan.PadodorGen.Win32.21
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
K7GWTrojan ( 005780dd1 )
Cybereasonmalicious.bd2932
BitDefenderThetaAI:Packer.19B3059D1E
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32Win32/Padodor.NAM
APEXMalicious
CynetMalicious (score: 100)
KasperskyBackdoor.Win32.Padodor.gen
BitDefenderGen:Trojan.ShellObject.h0Y@aGjJTmg
NANO-AntivirusTrojan.Win32.Padodor.flhjdn
AvastWin32:BackdoorX-gen [Trj]
TencentTrojan.Win32.Padodor.he
TACHYONBackdoor/W32.Padodor
SophosML/PE-A
F-SecureTrojan.TR/Dropper.Gen
VIPREGen:Trojan.ShellObject.h0Y@aGjJTmg
Trapminemalicious.high.ml.score
EmsisoftGen:Trojan.ShellObject.h0Y@aGjJTmg (B)
IkarusTrojan.Crypt
GDataWin32.Trojan.PSE.9FITS9
JiangminBackdoor.Padodor.exyu
GoogleDetected
AviraTR/Dropper.Gen
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
ArcabitTrojan.ShellObject.EDEE5D
ZoneAlarmBackdoor.Win32.Padodor.gen
MicrosoftBackdoor:Win32/Padodor.SK!MTB
VaristW32/Pahador.QLFO-8537
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
VBA32Backdoor.Padodor
ALYacGen:Trojan.ShellObject.h0Y@aGjJTmg
MAXmalware (ai score=85)
Cylanceunsafe
PandaTrj/Genetic.gen
RisingBackdoor.Berbew!1.AF13 (CLASSIC)
YandexBackdoor.Padodor.AF
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GenKryptik.FBNK!tr
AVGWin32:BackdoorX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment