Trojan:Win32/WhisperGate.ES!MTB information

The Trojan:Win32/WhisperGate.ES!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/WhisperGate.ES!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/WhisperGate.ES!MTB?


File Info:
name: B3DEE2B9919A23F6991E.mlw
path: /opt/CAPEv2/storage/binaries/ef2d4ccb09d4c01ed9c824e0a782b4f2abbf70b84adfb7835a31df512052f5d9
crc32: 93D94F4E
md5: b3dee2b9919a23f6991e3125156c023f
sha1: a4cb33da8af0caec9528faf4ef911e9857940f1f
sha256: ef2d4ccb09d4c01ed9c824e0a782b4f2abbf70b84adfb7835a31df512052f5d9
sha512: 35325456fafd8d79d255827753d8cbd4242d6963d42cae8b20a2b29a9fe811edaad02c7a393e699b57f2e514ba5d8e2a720a96f6f649149b9e9ee27d81b3b059
ssdeep: 768:Q7cJOZEcWKv2SDp/i6wRKwR9ZELd8PP3lLuzZPKqQfsSOg77xobe8gkRm:QYJhMls6kKk9E+PP3lLuBZQfsSOg77aO
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1DE230955BA648CEBE651633E80EBC77B5B7DF1818B231B93B734BB345B133922094246
sha3_384: 1ade8bf8af6f4fafe562088e2185fcf18f9becdee4ec470cc6815951224735624881cea48efd2bae99f2909aec90030e
ep_bytes: 83ec1cc7042401000000ff151c924000
timestamp: 2023-12-22 08:50:37

Version Info:
0: [No Data]

Trojan:Win32/WhisperGate.ES!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Gen:Variant.Zusy.531372
ClamAV	Win.Trojan.Generic-10017566-0
FireEye	Generic.mg.b3dee2b9919a23f6
Skyhigh	BehavesLike.Win32.Injector.pm
ALYac	Gen:Variant.Zusy.531372
Cylance	unsafe
VIPRE	Gen:Variant.Zusy.531372
Sangfor	Suspicious.Win32.Save.a
Alibaba	Trojan:Win32/WhisperGate.1a1d750a
Cybereason	malicious.a8af0c
Arcabit	Trojan.Zusy.D81BAC
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent_AGen.CZP
Cynet	Malicious (score: 100)
BitDefender	Gen:Variant.Zusy.531372
Avast	FileRepMalware [Misc]
Emsisoft	Gen:Variant.Zusy.531372 (B)
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Agent
Jiangmin	Trojan.Generic.bjgvg
Google	Detected
Kingsoft	malware.kb.a.903
Gridinsoft	Trojan.Win32.Agent.sa
Microsoft	Trojan:Win32/WhisperGate.ES!MTB
GData	Gen:Variant.Zusy.531372
Varist	W32/Kryptik.LIO.gen!Eldorado
McAfee	Artemis!B3DEE2B9919A
MAX	malware (ai score=80)
Malwarebytes	Trojan.Injector
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.CZK!tr
BitDefenderTheta	Gen:NN.ZexaF.36680.c0Y@a4DGJTf
AVG	FileRepMalware [Misc]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Trojan:Win32/WhisperGate.ES!MTB?

Trojan:Win32/WhisperGate.ES!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X