Bird Agent Backdoor config.toml MachineGuid Binding

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•3

Detects Bird Agent malware samples that exhibit characteristic behavior of binding configuration decryption to the Windows MachineGuid registry value. The rule identifies binaries that contain references to 'config.toml' and the Windows Cryptography registry key used to retrieve the MachineGuid, often used as a unique machine-based key for decryption.