VHO:Backdoor.Win32.Padodor (file analysis)

The VHO:Backdoor.Win32.Padodor is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VHO:Backdoor.Win32.Padodor virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine VHO:Backdoor.Win32.Padodor?


File Info:
name: FF615002417F96AF8BEB.mlw
path: /opt/CAPEv2/storage/binaries/a399bdd5400e09b1739c47a7ef2a06587b4183686be7f6e7f0b76cadb8397e80
crc32: 1C39ED77
md5: ff615002417f96af8beb0b6c9bfdde97
sha1: 05530b7640e38eef21d57f046ae6b8a7b7e93db1
sha256: a399bdd5400e09b1739c47a7ef2a06587b4183686be7f6e7f0b76cadb8397e80
sha512: 04a3245f6c9719fb4db8ad307d054205cbef5b297a3b0543d8a6a3479e2657b04ec6ec0022c8da21411a973019eebf686ba51cb2485d7602c449b2c2deb8458c
ssdeep: 1536:CHBj87C2t3mBEh5ettQkK+++2VcNYB72U2LsaIZTJ+7LhkiB:CHieBCOS+++CzBSsaMU7ui
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EB345B97E6B44FB1C9B8C276007787F6F72E51358417BD78A810D1B802B35AD44AABF2
sha3_384: 65a13f05e52d5fd462aa129c6f0d1d0d256a92b1d9d96fba8e716b5bbf44bb6246c821afa0b6290917a43187dcc04af0
ep_bytes: 00000000000000000000000000000000
timestamp: 1987-01-13 04:22:33

Version Info:
0: [No Data]

VHO:Backdoor.Win32.Padodor also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
FireEye	Generic.mg.ff615002417f96af
Skyhigh	BehavesLike.Win32.Generic.dz
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.640e38
Baidu	Win32.Trojan-Spy.Quart.a
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Packed.Barys-10002300-0
Kaspersky	VHO:Backdoor.Win32.Padodor.gen
Rising	Backdoor.Berbew!1.AE0A (CLASSIC)
Sophos	ML/PE-A
F-Secure	Trojan.TR/Crypt.ZPACK.Gen2
DrWeb	Trojan.Siggen13.57251
TrendMicro	TROJ_GEN.R03BC0DJT23
SentinelOne	Static AI – Malicious PE
Google	Detected
Avira	TR/Crypt.ZPACK.Gen2
Varist	W32/Padodor.F.gen!Eldorado
Kingsoft	malware.kb.a.774
Microsoft	Trojan:Win32/Cerber.MPI!MTB
ZoneAlarm	VHO:Backdoor.Win32.Padodor.gen
Cynet	Malicious (score: 100)
McAfee	GenericRXVP-WI!FF615002417F
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.AI.DDS
TrendMicro-HouseCall	TROJ_GEN.R03BC0DJT23
Ikarus	Trojan.Win32.Cerber
MaxSecure	Banker.Win64.Emotet.sb
Fortinet	W32/Padodor.A!dam
AVG	Win32:Evo-gen [Trj]
Avast	Win32:Evo-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove VHO:Backdoor.Win32.Padodor?

VHO:Backdoor.Win32.Padodor removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X