Medium S2W WhisperGate January 2022

WhisperGate can Base64 encode strings, store downloaded files in reverse byte order, and use the Eazfuscator tool to obfuscate its third stage.

WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.

WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.

WhisperGate can make an HTTPS connection to download additional files.

WhisperGate can locate files based on hardcoded file extensions.

WhisperGate can download additional payloads hosted on a Discord channel.

WhisperGate can download additional stages of malware from a Discord CDN channel.

WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.

WhisperGate can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.

WhisperGate can pause for 20 seconds to bypass antivirus solutions.

WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.

WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets.

WhisperGate can overwrite the Master Book Record (MBR) on victim systems with a malicious 16-bit bootloader.

WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.

WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.