Procedure examples

WhisperGate can Base64 encode strings, store downloaded files in reverse byte order, and use the Eazfuscator tool to obfuscate its third stage.

WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.

WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.

WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.

WhisperGate can use `cmd.exe` to execute commands.

WhisperGate can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.

WhisperGate can delete tools from a compromised host after execution.

WhisperGate can make an HTTPS connection to download additional files.

WhisperGate can locate files based on hardcoded file extensions.

WhisperGate can download additional payloads hosted on a Discord channel.

WhisperGate can download additional stages of malware from a Discord CDN channel.

WhisperGate has used the `ExitWindowsEx` to flush file buffers to disk and stop running processes and other API calls.

The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via `%TEMP%\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run`.

WhisperGate can enumerate connected remote logical drives.

WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.

WhisperGate has used `InstallUtil.exe` as part of its process to disable Windows Defender.

WhisperGate can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.

WhisperGate can stop its execution when it recognizes the presence of certain monitoring tools.

WhisperGate can pause for 20 seconds to bypass antivirus solutions.

WhisperGate can recognize the presence of monitoring tools on a target system.

WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.

WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.

WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets.

WhisperGate can overwrite the Master Book Record (MBR) on victim systems with a malicious 16-bit bootloader.

WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.

WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.

WhisperGate has the ability to enumerate fixed logical drives on a targeted system.

WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.