Home / malware

PDF

Trojan:Win32/DelfInject

First posted on 05 April 2019.
Source: Microsoft

Aliases :

There are no other names known for Trojan:Win32/DelfInject.

Explanation :

The tools that are used to obfuscate the threats are compiled in the Delphi programming language.

A malicious file is generally encrypted and/or compressed and stored inside another program, which decodes the malicious file and loads it. The malicious program may be injected into a clean process or loaded in a new process of its own. 

This type of obfuscation has been used on a variety of different malware, especially several different families of instant messaging (IM) and Internet relay chat (IRC) bots such as Worm:Win32/Scrimge, Worm:Win32/Slenfbot and Worm:Win32/Pushbot.

Other malware families such as Win32/Rimecud, Win32/Zbot and Win32/Hamweq have also been observed using Delfinject.

Last update 05 April 2019

 

TOP