WhiteBird
- Malware type
- backdoor
- Profile updated
- 2026-07-07 15:11:46
Context
According to Dr.Web, WhiteBird is a backdoor written in C++ and designed to operate in both 32-bit and 64-bit Microsoft Windows operating systems. The configuration is encrypted with a single byte XOR key. An interesting feature is that the malware can be restricted to operate only within certain "working_hours" with a granularity of one minute.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Whitebird_Auto (yara-rule)
Reports & references
- st.drweb.com — Study Of The Apt Attacks On State Institutions In Kazakhstan And Kyrgyzstan En (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Whitebird (report)
- st.drweb.com — Tek Rf Article En (report)