{
  "family": "delphi",
  "sample_count": 82,
  "category": "trojan",
  "description": "Delphi (cataloged across antivirus vendors under signatures including Win32/Delphi, Virus:Win32/Delphi, and Trojan:Win32/Delphi) represents a broad classification and heuristic family identifying malicious programs compiled using Embarcadero and Borland Delphi. Delphi-compiled malware is characterized by its large standard binary footprint, distinctive Visual Component Library (VCL) runtime metadata, Run-Time Type Information (RTTI) structures, and reliance on unified PE section layouts. Historically prominent within this software ecosystem was Virus:Win32/Induc.A—a notorious Delphi compiler infector discovered in 2009 that modified SysConst.pas in Delphi IDE installations to silently inject self-replicating infection routines into every clean software application subsequently compiled by developers. Beyond Induc, malware authors widely favor Delphi for rapid prototyping of banking trojans, keyloggers, and botnet downloaders due to its native GUI development tools, comprehensive socket networking libraries, and inherent resilience against standard static signature decompilers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Win32/Delphi",
    "Virus:Win32/Delphi",
    "Trojan:Win32/Delphi",
    "Win32.Delphi"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Win32/Delphi malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Win32/Delphi refers to malware strains and heuristic detections compiled with Borland or Embarcadero Delphi."
      }
    },
    {
      "@type": "Question",
      "name": "Why do malware authors frequently write malicious software in Delphi?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Delphi enables rapid GUI creation, has native network libraries, and compiles to complex binaries that hinder static analysis."
      }
    },
    {
      "@type": "Question",
      "name": "What was the landmark Virus:Win32/Induc.A incident?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Induc.A infected the Delphi compiler itself by patching SysConst.pas, causing every compiled binary to spread the virus."
      }
    },
    {
      "@type": "Question",
      "name": "What common behavioral traits are seen in Delphi-based trojans?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Common behaviors include registry autostart persistence, keyboard hooking, credential theft, and HTTP command-and-control beaconing."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Delphi-compiled malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy modern behavioral EDR solutions, enforce strict application whitelisting, and verify software digital signatures."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1059.003",
    "T1547.001",
    "T1082",
    "T1056.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1129",
      "name": "Shared Modules",
      "tactic": "Execution"
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactic": "Execution"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; Delphi-compiled malware is frequently utilized in targeted attacks (banking trojans or RATs).",
    "Capture a full forensic memory image to preserve the running state of the malware, especially if it operates primarily in memory.",
    "Submit the binary to a specialized malware analyst familiar with reversing Delphi executables and the VCL architecture.",
    "Perform a comprehensive system sweep to identify how the unapproved executable arrived on the endpoint (e.g., phishing attachment)."
  ],
  "what_to_avoid": [
    "Do not assume the threat is minor; many of the most devastating banking trojans targeting Latin America are written in Delphi.",
    "Avoid relying solely on basic static analysis strings; Delphi utilizes a unique string storage mechanism that can confuse standard analysis tools."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Software Supply Chain Infection & Cybercrime",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2009,
  "threat_actor": null,
  "delivery_mechanism": [
    "Compromised Software Toolchains",
    "Phishing Email Attachments",
    "Pirated Software & Keygens"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "Compiler Source Infection (Induc)",
    "Visual Component Library GUI Emulation",
    "Keyboard Event Hooking",
    "Registry Autostart Modification",
    "Encrypted Network Beaconing"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Delphi Unit Source (.pas)"
    ],
    "network_signatures": [
      "HTTP POST beacons with custom Delphi Indy socket headers",
      "DNS queries to dynamic C2 domain infrastructure"
    ],
    "evasion_techniques": [
      "Heavy VCL runtime bloat obscuring malicious execution loops",
      "Obfuscated Delphi RTTI structures to disrupt IDA Pro function parsing"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DelphiService",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinSystemCheck"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Developer toolchain contamination, endpoint credential compromise, arbitrary trojan execution"
  },
  "lineage": {
    "derived_from": [
      "Embarcadero / Borland Delphi Codebases"
    ],
    "variants": [
      "Virus:Win32/Induc.A",
      "Trojan:Win32/Delphi.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2",
      "d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3"
    ],
    "delivery": [
      "delphi_payload.exe",
      "sysconst_patcher.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DelphiHelper",
      "%AppData%\\Delphi\\delphi_daemon.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Virus:Win32/Induc.A",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Induc.A"
    },
    {
      "name": "Kaspersky Securelist - Analysis of Induc Delphi Compiler Virus",
      "url": "https://securelist.com"
    }
  ]
}