What is “Trojan:Win32/WhisperGate.ES!MTB”?

The Trojan:Win32/WhisperGate.ES!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/WhisperGate.ES!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/WhisperGate.ES!MTB?


File Info:
name: 0F182DD9E412441DFFFF.mlw
path: /opt/CAPEv2/storage/binaries/26de3287ea97a8b3f10d9961a497b3d9526630449165f88b6066bc8320766f80
crc32: B586A8DA
md5: 0f182dd9e412441dffff294e06542263
sha1: ae5be4350811d74294ab287f203ed0a5d08dfdf2
sha256: 26de3287ea97a8b3f10d9961a497b3d9526630449165f88b6066bc8320766f80
sha512: 615281e12638b4793913d9e1829030d09b3994765d33b8c9a8d927ca655d85a2be2a85634f5af0f7c4a9012dabbfa20f2554be314118c5496ef55c929ac26dc5
ssdeep: 768:3DSOmuxptEA8hB+pmidZE69APP3lLuzZPKqQ7OgDHhHoNixGhfbgdR5:3DSOr6hA9dByPP3lLuBZQ7RDBH6iUhfm
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T17F230855BE658CEBE652633E80EBC37B5B7DF5818B231B53B734BB305B132922094246
sha3_384: f47f5f44b9497c5d09f312be7ebbe363a0efc7b4ceb3406ff05f3dc0a726a6da1047c7d03ee848be33b1f0dc16810c84
ep_bytes: 83ec1cc7042401000000ff1528924000
timestamp: 2023-12-22 09:24:38

Version Info:
0: [No Data]

Trojan:Win32/WhisperGate.ES!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Gen:Variant.Zusy.531604
ClamAV	Win.Trojan.Generic-10017566-0
FireEye	Generic.mg.0f182dd9e412441d
Skyhigh	BehavesLike.Win32.Generic.pm
McAfee	Artemis!0F182DD9E412
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005b00591 )
Alibaba	Trojan:Win32/WhisperGate.0960ad50
K7GW	Trojan ( 005b00591 )
Cybereason	malicious.50811d
Arcabit	Trojan.Zusy.D81C94
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent_AGen.CZP
Cynet	Malicious (score: 100)
BitDefender	Gen:Variant.Zusy.531604
Avast	FileRepMalware [Misc]
Emsisoft	Gen:Variant.Zusy.531604 (B)
VIPRE	Gen:Variant.Zusy.531604
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.Generic.bjgvg
Google	Detected
Kingsoft	malware.kb.a.983
Microsoft	Trojan:Win32/WhisperGate.ES!MTB
GData	Win32.Trojan.PSE.1B885XN
Varist	W32/Kryptik.LIO.gen!Eldorado
AhnLab-V3	Trojan/Win.TrojanX-gen.R630362
BitDefenderTheta	Gen:NN.ZexaF.36680.c0Y@aW55cic
MAX	malware (ai score=82)
Malwarebytes	Trojan.Injector
Rising	Trojan.Agent!8.B1E (TFE:5:daiSIuctnLD)
Ikarus	Trojan-Downloader.Win32.Small
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.CZK!tr
AVG	FileRepMalware [Misc]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Trojan:Win32/WhisperGate.ES!MTB?

Trojan:Win32/WhisperGate.ES!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X