Backdoor

Backdoor:Win32/Padodor.SK!MTB (file analysis)

Malware Removal

The Backdoor:Win32/Padodor.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Padodor.SK!MTB virus can do?

  • Creates an indicator observed in Territorial Disputes report SIG40
  • Authenticode signature is invalid
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Padodor.SK!MTB?



File Info:

name: 37EB4A7FAF884D2B5A45.mlw
path: /opt/CAPEv2/storage/binaries/f836d8802f62d0458adc6979a01f2b5cc414bdb24326624a68482e0aa2e473d1
crc32: 2CD64DC9
md5: 37eb4a7faf884d2b5a458d453ea9a79c
sha1: b0a3492e4caf450a1070c3d80996c11518364a52
sha256: f836d8802f62d0458adc6979a01f2b5cc414bdb24326624a68482e0aa2e473d1
sha512: 57c31cd046b714baf9b15119bc2708f027d788f068a67225de330ecf16e692c2fcc8af818fa92ddeab261db1b11a457cbcf34a8ed0340fc1b4eea447ce3a012c
ssdeep: 1536:V5U5GBdJLoVYjemhinxFtRwn6g6hnCV19zQYOd5ijJnD5ir3oGuiWDD:ViGBdloVYje5nUJ6huO7AJnD5tvv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T189C36D1BB6471F62CB8702B526025FF6B729C9344F7DC19315BEC0CF1256E2D82B6992
sha3_384: 0bdc461a67e57e5de7800f9c34a9cee877c0bffd57755d2aef31ad87ad2b2e50dff26510a91f1a80735b9b01ec411c0b
ep_bytes: 90909090609090b80010400090bb38de
timestamp: 1982-02-08 05:39:38


Version Info:

0: [No Data]

Backdoor:Win32/Padodor.SK!MTB also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Padodor.m!c
Elasticmalicious (high confidence)
DrWebBackDoor.Wdozer
MicroWorld-eScanGenPack:Trojan.GenericKDZ.103285
FireEyeGeneric.mg.37eb4a7faf884d2b
SkyhighBehavesLike.Win32.Generic.ch
McAfeeTrojan-FVOJ!37EB4A7FAF88
MalwarebytesGeneric.Malware.AI.DDS
VIPREGenPack:Trojan.GenericKDZ.103285
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005780dd1 )
BitDefenderGenPack:Trojan.GenericKDZ.103285
K7GWTrojan ( 005780dd1 )
Cybereasonmalicious.e4caf4
BitDefenderThetaAI:Packer.129D9E5E21
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
ESET-NOD32Win32/Padodor.AB
APEXMalicious
ClamAVWin.Trojan.Crypted-29
KasperskyBackdoor.Win32.Padodor.gen
AlibabaBackdoor:Win32/Padodor.fe87c16c
NANO-AntivirusTrojan.Win32.Padodor.kbnwln
ViRobotTrojan.Win.Z.Padodor.123904.AQCG
RisingBackdoor.Berbew!8.115 (TFE:2:fIx4TDg4RLD)
SophosTroj/Padodo-Gen
F-SecureTrojan.TR/Crypt.XDR.Gen
ZillyaTrojan.Padodor.Win32.697000
TrendMicroTROJ_GEN.R002C0DK323
Trapminemalicious.high.ml.score
EmsisoftGenPack:Trojan.GenericKDZ.103285 (B)
SentinelOneStatic AI – Malicious PE
MAXmalware (ai score=82)
JiangminBackdoor.Padodor.erlj
GoogleDetected
AviraTR/Crypt.XDR.Gen
VaristW32/Backdoor.DKIC-2994
Antiy-AVLTrojan[Proxy]/Win32.Qukart.gen
Kingsoftmalware.kb.a.1000
MicrosoftBackdoor:Win32/Padodor.SK!MTB
ArcabitGenPack:Trojan.Generic.D19375
ZoneAlarmBackdoor.Win32.Padodor.gen
GDataWin32.Trojan.PSE.J9SS1X
CynetMalicious (score: 100)
AhnLab-V3Win-Trojan/Berbew.51712
Acronissuspicious
VBA32Backdoor.Padodor
ALYacGenPack:Trojan.GenericKDZ.103285
TACHYONBackdoor/W32.Padodor
DeepInstinctMALICIOUS
Cylanceunsafe
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_GEN.R002C0DK323
TencentBackdoor.Win32.Padodor.kp
IkarusTrojan.Crypt
FortinetW32/GenKryptik.BJQV!tr
AVGWin32:Padodor-V [Trj]
AvastWin32:Padodor-V [Trj]
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Backdoor:Win32/Padodor.SK!MTB?

Backdoor:Win32/Padodor.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment