The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via %TEMP%\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run.^[4]

WhisperGate can make an HTTPS connection to download additional files.^[2][5]

WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.^[2][4][5]

WhisperGate can use cmd.exe to execute commands.^[2]

WhisperGate can use a Visual Basic script to exclude the C:\ drive from Windows Defender.^[2][4]

WhisperGate can corrupt files by overwriting the first 1 MB with 0xcc and appending random extensions.^{[3][6][1][2][4][5]}

WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.^[4][5]

WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.^[2][4][5]

WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets.^[6][4][5]

WhisperGate can overwrite the Master Book Record (MBR) on victim systems with a malicious 16-bit bootloader.^{[3][6][1][2][4][5]}

WhisperGate can locate files based on hardcoded file extensions.^[3][2][4][5]

WhisperGate can delete tools from a compromised host after execution.^[4]

WhisperGate can download additional stages of malware from a Discord CDN channel.^[3][2][4][5]

WhisperGate has the ability to enumerate fixed logical drives on a targeted system.^[4]

WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.^[5]

WhisperGate has used the ExitWindowsEx to flush file buffers to disk and stop running processes and other API calls.^[4][7]

WhisperGate can enumerate connected remote logical drives.^[4]

WhisperGate can Base64 encode strings, store downloaded files in reverse byte order, and use the Eazfuscator tool to obfuscate its third stage.^[4][5][7]

WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.^{[6][1][3][4][5]}

WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility InstallUtil.exe.^[4][7]

WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.^[7]

WhisperGate can recognize the presence of monitoring tools on a target system.^[2]

WhisperGate has used InstallUtil.exe as part of its process to disable Windows Defender.^[2]

WhisperGate can download and execute AdvancedRun.exe via sc.exe.^[5][2]

WhisperGate can shutdown a compromised host through execution of ExitWindowsEx with the EXW_SHUTDOWN flag.^[4]

WhisperGate can stop its execution when it recognizes the presence of certain monitoring tools.^[2]

WhisperGate can pause for 20 seconds to bypass antivirus solutions.^[5][7]

WhisperGate can download additional payloads hosted on a Discord channel.^{[6][2][3][4][5]}

Ember Bear is associated with WhisperGate use against multiple victims in Ukraine.^[8][9][10]