{
  "family": "delfinject",
  "sample_count": 26,
  "category": "trojan",
  "description": "DelfInject (cataloged across security intelligence feeds under signatures including Trojan:Win32/DelfInject, VirTool:Win32/DelfInject, and Trojan.DelfInject) is an evasive Delphi-compiled trojan loader, runtime crypter, and process injector active since 2014. Widely utilized in crimeware campaigns to distribute commodity remote access trojans (RATs) and banking malware, DelfInject encapsulates raw binary payloads inside an encrypted PE overlay or Delphi resource section. Upon launch, DelfInject performs anti-debugging and anti-VM checks (inspecting RDTSC timing, registry hardware keys, and VMware/VirtualBox drivers). It then unhooks user-mode NT APIs (ntdll.dll), allocates executable memory in legitimate target processes like svchost.exe or explorer.exe via VirtualAllocEx and WriteProcessMemory, and executes the decrypted payload using CreateRemoteThread or NtQueueApcThread.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/DelfInject",
    "VirTool:Win32/DelfInject",
    "Trojan.DelfInject",
    "Win32/DelfInject",
    "Trojan:Win32/DelfInject.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/DelfInject?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DelfInject is a Delphi-compiled trojan injector and crypter that executes encrypted secondary malware inside legitimate processes."
      }
    },
    {
      "@type": "Question",
      "name": "How does DelfInject evade sandbox detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It performs RDTSC CPU cycle timing checks, searches for virtual machine drivers, and delays execution using high-resolution sleep routines."
      }
    },
    {
      "@type": "Question",
      "name": "What injection methods are used by DelfInject?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to inject shellcode into svchost.exe or explorer.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware is commonly delivered by DelfInject?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DelfInject is frequently used to deliver remote access trojans (njRAT, AsyncRAT), info-stealers, and banking trojans."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect DelfInject activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor for cross-process memory allocations and remote thread creation targeting svchost.exe using behavioral EDR tools."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.001",
    "T1055.004",
    "T1027",
    "T1497.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Weaponized Attachments",
    "Trojanized Keygens & Cracks",
    "Exploit Kit Drive-by Compromise"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Process Injection into svchost.exe & explorer.exe",
    "In-Memory Decryption of PE Payloads",
    "Anti-Debugging & RDTSC Timing Evasion",
    "User-Mode NT API Unhooking (ntdll.dll)",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Borland Delphi)",
      "Encrypted Overlay Blob"
    ],
    "network_signatures": [
      "Outbound C2 connections initiated from injected legitimate system processes rather than the parent Delphi executable",
      "Periodic DNS lookups for dynamic C2 hosting domains"
    ],
    "evasion_techniques": [
      "Overwriting ntdll.dll in memory with a clean copy to strip endpoint security API hooks",
      "Using encrypted RC4 overlays to hide binary payload signatures from static scanners"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7af8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
      "8ba9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DelfLoader",
      "HKCU\\Software\\DelfInject"
    ],
    "file_paths": [
      "%Temp%\\delf_stage.exe",
      "%AppData%\\DelfInject\\stub.dat",
      "%LocalAppdata%\\Temp\\bin.tmp"
    ]
  },
  "defensive_measures": [
    "Configure EDR alerts for cross-process memory writing (WriteProcessMemory) and remote thread injection into svchost.exe",
    "Enforce application control policies blocking unverified executables from running in %Temp% and %AppData%",
    "Monitor for unhooking behavior where processes reload or overwrite sections of ntdll.dll"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/DelfInject",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DelfInject"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.DelfInject",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/DelfInject.A",
      "VirTool:Win32/DelfInject.gen"
    ]
  },
  "motivation": "Initial Access Facilitation, Defense Evasion & Pay-Per-Install Staging",
  "sample_hashes": []
}