Summary

File 386081343cf961e704f170905c40c779e6bb552e9a8f956481fead6e08b3fb35

Summary

Download Resubmit sample

Size	91.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	e13e67b89f85bba74f9b99a37d214ba3
SHA1	915214de88c0b3b71d596544ed0266d881b45190
SHA256	386081343cf961e704f170905c40c779e6bb552e9a8f956481fead6e08b3fb35
SHA512	Show SHA512 679b16ca5bf5b352be7b264561cdac28c8704e47e1d8f0816a69ed8d5223670a0e6a4265670700dfd395a29e9e3f8e23eda0dcdc2d1e485700ab36f70b824aa0
CRC32	5892B90E
ssdeep	None
Yara	network_tcp_listen - Listen for incoming communication network_tcp_socket - Communications over RAW socket network_dns - Communications use DNS screenshot - Take screenshot cred_local - Steal credential win_mutex - Create or check mutex win_registry - Affect system registries win_files_operation - Affect private profile

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

7188394

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (8 events)

description	Listen for incoming communication				rule	network_tcp_listen
description	Communications over RAW socket				rule	network_tcp_socket
description	Communications use DNS				rule	network_dns
description	Take screenshot				rule	screenshot
description	Steal credential				rule	cred_local
description	Create or check mutex				rule	win_mutex
description	Affect system registries				rule	win_registry
description	Affect private profile				rule	win_files_operation

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.flh

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 9, 2025, 9:10 a.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x77ab9f72 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x77ab9f45 exception.instruction_r: df a2 4d e1 62 ca 39 ab 30 8a 51 61 44 43 74 31 exception.symbol: iacblp32+0x1223 exception.address: 0x401223 exception.module: Iacblp32.exe exception.exception_code: 0xc0000005 exception.offset: 4643 registers.esp: 1638284 registers.edi: 0 registers.eax: 656497416 registers.ebp: 1638292 registers.edx: 4198937 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1	0	0

Creates executable files on the filesystem (2 events)

file	C:\Windows\System32\Iacblp32.exe
file	C:\Windows\System32\Ajgmlm32.dll

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger

reg_value

{79FAA099-1BAE-816E-D711-115290CEE717}

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Trojan.GenericKDZ.103285 (Engine A)
Avast Core Security (Linux)	Win32:Padodor-S [Trj]
C4S ClamAV (Linux)	Win.Trojan.Padodor-9877164-0
Trellix (Linux)	ACL/Generic.MDQJ trojan
WithSecure (Linux)	Trojan.TR/Crypt.XPACK.Gen
eScan Antivirus (Linux)	Trojan.GenericKDZ.103285(DB)
ESET Security (Windows)	Win32/Padodor.AB trojan
Sophos Anti-Virus (Linux)	Mal/Padodor-A
DrWeb Antivirus (Linux)	BackDoor.Wdozer
ClamAV (Linux)	Win.Trojan.Padodor-9877164-0
Bitdefender Antivirus (Linux)	Trojan.GenericKDZ.103285
Kaspersky Standard (Windows)	Backdoor.Win32.Padodor.gen
Emsisoft Commandline Scanner (Windows)	Trojan.GenericKDZ.103285 (B)

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Ghanarava.165339839034a75f
Skyhigh	BehavesLike.Win32.PadodorTrojan.nh
ALYac	Trojan.GenericKDZ.103285
Cylance	Unsafe
VIPRE	Trojan.GenericKDZ.103285
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Trojan.GenericKDZ.103285
K7GW	EmailWorm ( 005ccfa11 )
K7AntiVirus	EmailWorm ( 005ccfa11 )
Arcabit	Trojan.Generic.D19375
Baidu	Win32.Backdoor.Padodor.a
VirIT	Backdoor.Win32.Wdozer.A
Symantec	Backdoor.Berbew
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Padodor.AB
APEX	Malicious
Avast	Win32:Padodor-S [Trj]
ClamAV	Win.Trojan.Padodor-9877164-0
Kaspersky	Backdoor.Win32.Padodor.gen
NANO-Antivirus	Trojan.Win32.Padodor.dptlbk
MicroWorld-eScan	Trojan.GenericKDZ.103285
Rising	Backdoor.Berbew!1.AE6C (CLASSIC)
Emsisoft	Trojan.GenericKDZ.103285 (B)
F-Secure	Trojan.TR/Crypt.XPACK.Gen
DrWeb	BackDoor.Wdozer
Zillya	Backdoor.Padodor.Win32.134
McAfeeD	Real Protect-LS!E13E67B89F85
Trapmine	malicious.high.ml.score
CTX	exe.trojan.generickdz
Sophos	Mal/Padodor-A
SentinelOne	Static AI - Malicious PE
Jiangmin	Backdoor/Padodor.du
Google	Detected
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan[Backdoor]/Win32.Padodor
Kingsoft	malware.kb.a.1000
Gridinsoft	Ransom.Win32.Sabsik.oa!s1
Microsoft	Backdoor:Win32/Berbew.AA
ZoneAlarm	Mal/Padodor-A
GData	Win32.Backdoor.Berbew.D
Varist	W32/Trojan.DEXB-6979
AhnLab-V3	Trojan/Win.Generic.C5393989
Acronis	suspicious
VBA32	Backdoor.Padodor
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.Gen.DDS

Screenshots