Threats Tagged 'delphi'

Grandoreiro, a notorious banking trojan active since 2016 across Latin America, continues operations despite major law enforcement disruption in 2024. Recent campaigns leverage DLL sideloading techniques, abusing the legitimate Duplicate Files Finder application to execute malicious code. The loader incorporates extensive anti-analysis mechanisms including sandbox detection, virtual machine artifact checks, process blacklisting, and environment profiling to evade automated analysis systems. These defensive checks occur before C2 contact, indicating high priority on avoiding detection. Telemetry from June 2026 shows activity concentrated in Latin America, primarily Mexico, with limited presence in Europe and North America. The malware uses custom string obfuscation combining proprietary decryption with Base64 encoding, and communicates with C2 infrastructure over TCP port 6432 using encrypted requests containing host-specific information.

MediumMalwareMexicoSpain#sandbox evasion#grandoreiro#mexico

This report details the discovery and analysis of a Horabot malware campaign targeting primarily Mexican users. The attack chain begins with a fake CAPTCHA page leading to multiple stages of obfuscated scripts, ultimately delivering an AutoIT loader and a Delphi-based banking Trojan. The malware employs sophisticated encryption techniques, anti-VM checks, and a custom protocol for C2 communication. It also includes a spreader component written in PowerShell that harvests and exfiltrates email addresses to distribute phishing emails. The analysis reveals Brazilian Portuguese comments in the code, suggesting the threat actor's origin. The report provides detection opportunities including YARA rules and hunting queries to identify this threat.

MediumMalwareMexicoBrazilUnited States+2#ponteiro#delphi#brazil

Raven Stealer is a modern, lightweight information-stealing malware developed in Delphi and C++. It targets Chromium-based browsers to extract sensitive data, including passwords, cookies, and payment details. The malware uses a modular architecture and UPX packing to evade detection. It executes stealthily and exfiltrates data via Telegram bot integration. Distributed through GitHub and promoted on Telegram, Raven Stealer's user-friendly interface and dynamic module support make it attractive in the commodity malware ecosystem. The malware's capabilities include credential theft, browser data harvesting, and real-time exfiltration, posing a significant threat when used maliciously.

MediumMalwareGermanyFranceItaly+5#browser data#c++#octalyn stealer

TAG-140, a threat actor group overlapping with SideCopy, has deployed an updated version of their DRAT remote access trojan, dubbed DRAT V2. This new variant, developed in Delphi, introduces enhanced command and control capabilities, including arbitrary shell command execution and improved C2 obfuscation techniques. The malware was distributed through a ClickFix-style social engineering attack, using a cloned Indian Ministry of Defence press portal. DRAT V2 demonstrates TAG-140's ongoing refinement of their tooling and their continued focus on Indian government and defense targets.

MediumMalwareUnited KingdomGermanyFrance+2#remote access trojan#drat v2#c2 obfuscation