About “Trojan:Win32/WhisperGate.RA!MTB” infection

The Trojan:Win32/WhisperGate.RA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/WhisperGate.RA!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/WhisperGate.RA!MTB?


File Info:
name: 3F053EB423C9024EA681.mlw
path: /opt/CAPEv2/storage/binaries/dd2dfc67328bec7fab29ac787aedad270f7103f7f9bfb1e44a1b52f0fa7eda94
crc32: 7F784A12
md5: 3f053eb423c9024ea681fcd98e8b72d1
sha1: cb7c8ee81f0f1e08ba517feb6ea90bdabaae4512
sha256: dd2dfc67328bec7fab29ac787aedad270f7103f7f9bfb1e44a1b52f0fa7eda94
sha512: 1148e8d9edee0a1b5e2d710fc46a7ddabb2fc3504caa98052def84574325d548c0c90a5ce28862613e3e585fdca31315388dc11a290987c21c71de7565c5311e
ssdeep: 768:WThEUB4Ak5nAZEYRBPP3lLuzZPKqAcNoSCUAxo8BzgdRm:Wf4bxAzPPP3lLuBZAceVUAa8BzT
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T12E230995BD648CEBE652633E80EBC37A5B7DF1818B235B53B734BB301B132922095246
sha3_384: d33fa679bebb3e92ed44357423bfa166709821c59864d2cffda6e9c796db74bd8accad52a650c5940cc00c04d250f082
ep_bytes: 83ec1cc7042401000000ff1514924000
timestamp: 2023-12-22 17:24:10

Version Info:
0: [No Data]

Trojan:Win32/WhisperGate.RA!MTB also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.531379
Malwarebytes	Trojan.Injector
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.81f0f1
Arcabit	Trojan.Zusy.D81BB3
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent_AGen.CZP
Cynet	Malicious (score: 100)
ClamAV	Win.Trojan.Generic-10017566-0
Kaspersky	HEUR:Trojan.Win32.Shellex.gen
BitDefender	Gen:Variant.Zusy.531379
Avast	Win32:Evo-gen [Trj]
Emsisoft	Gen:Variant.Zusy.531379 (B)
DrWeb	BACKDOOR.Trojan
VIPRE	Gen:Variant.Zusy.531379
Sophos	Troj/Inject-JGZ
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Generic.bjgvg
Varist	W32/Kryptik.LIO.gen!Eldorado
Antiy-AVL	Trojan/Win32.WhisperGate
Kingsoft	malware.kb.a.923
Microsoft	Trojan:Win32/WhisperGate.RA!MTB
ZoneAlarm	HEUR:Trojan.Win32.Shellex.gen
GData	Win32.Trojan.PSE.1LJBB7B
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R630086
BitDefenderTheta	Gen:NN.ZexaF.36680.c0Y@aGWWTwo
ALYac	Gen:Variant.Zusy.531379
Cylance	unsafe
Rising	Trojan.Agent!8.B1E (TFE:5:Hprdo0PYwVT)
Ikarus	Trojan.Win32.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.CZK!tr
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Trojan:Win32/WhisperGate.RA!MTB?

Trojan:Win32/WhisperGate.RA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X