What is “Trojan:Win32/WhisperGate.RA!MTB”?

The Trojan:Win32/WhisperGate.RA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/WhisperGate.RA!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/WhisperGate.RA!MTB?


File Info:
name: 5EBBC9D6B4FF9365A6CD.mlw
path: /opt/CAPEv2/storage/binaries/99719ce3ebb9876c713a14398df6723fb5e205de6aee22bdb70ac56b0db3e71d
crc32: 50AA2A7D
md5: 5ebbc9d6b4ff9365a6cdf6a7d76e25f3
sha1: 72c4b6e53d5b996bb2970366e6263e0b28fb7d73
sha256: 99719ce3ebb9876c713a14398df6723fb5e205de6aee22bdb70ac56b0db3e71d
sha512: 983594ec897f982e604f5a5854df73d9080c5079aded8b8bc7dd9775b1e8824f2fc0e8b914abc774910839d4321a3eb821cbc31362667bd2fe0763fce857ccf9
ssdeep: 768:TlE1KstJVwOd2ZEbRzPP3lLuzZPKqHwTLyjxo8Z8gkRm:xsTKOd2sdPP3lLuBZHwTLyja8Z8+
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T172230755BA648CEBE652633E80EBC77A5B7DF1818B234B53B734FB305B032922494246
sha3_384: c104e0464550afec4ada377f629550492b6d67a7e859d152adfef69c7f4be0f8f1081dd91a0e969c6b37584c15ee344b
ep_bytes: 83ec1cc7042401000000ff1520924000
timestamp: 2023-12-21 14:21:59

Version Info:
0: [No Data]

Trojan:Win32/WhisperGate.RA!MTB also known as:

Elastic	malicious (moderate confidence)
MicroWorld-eScan	Generic.Dacic.1206.BADE2AD7
Malwarebytes	Trojan.Injector
K7AntiVirus	Trojan ( 005b00591 )
K7GW	Trojan ( 005b00591 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent_AGen.CZP
Cynet	Malicious (score: 100)
ClamAV	Win.Trojan.Generic-10017566-0
Kaspersky	HEUR:Trojan.Win32.Shellex.gen
BitDefender	Generic.Dacic.1206.BADE2AD7
Tencent	Trojan.Win32.Agent.hel
Emsisoft	Generic.Dacic.1206.BADE2AD7 (B)
VIPRE	Generic.Dacic.1206.BADE2AD7
Sophos	Troj/Inject-JGZ
Ikarus	Trojan.Win32.Agent
GData	Win32.Trojan.PSE.1LJBB7B
Jiangmin	Trojan.Generic.bjgvg
Varist	W32/Kryptik.LIO.gen!Eldorado
Arcabit	Generic.Dacic.1206.BADE2AD7
ZoneAlarm	HEUR:Trojan.Win32.Shellex.gen
Microsoft	Trojan:Win32/WhisperGate.RA!MTB
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R630376
BitDefenderTheta	Gen:NN.ZexaF.36680.c0Y@aaOrBam
ALYac	Generic.Dacic.1206.BADE2AD7
VBA32	Trojan.Convagent
Cylance	unsafe
Rising	Trojan.Agent!8.B1E (TFE:5:ruAhjTd9NDH)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.CZK!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Trojan:Win32/WhisperGate.RA!MTB?

Trojan:Win32/WhisperGate.RA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X