Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Delphi Packer Looks for Human Behavior Before Deploying Payload
#1
Quote:Delphi is a legitimate integrated development environment (IDE) for rapid application development of desktop, mobile, web and console software, developed by Embarcadero Technologies. FireEye researchers have observed bad actors using it to more easily write malware that leverages Windows API functions to create anti-sandbox features.

“In fact, some actors deliberately include the default libraries as a diversion to hamper static analysis and make the application look legit during dynamic analysis,” they said, in a Thursday posting on the trend.

FireEye recently uncovered several malware samples in circulation using a unique Delphi-written packer that’s focused on using APIs to separate analysis environments from real targets.

“We…see an increased effort to model normal user activity and baseline it as an effective countermeasure to fingerprint malware analysis environments,” the team noted. They added that it looks for straightforward behavior: For instance, normal user activity typically involves application windows being changed, and mouse movements.

Source: https://threatpost.com/delphi-packer-loo...ad/137609/
[-] The following 1 user says Thank You to silversurfer for this post:
  • harlan4096
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)
[-]
Welcome
You have to register before you can post on our site.

Username/Email:


Password:





[-]
Recent Posts
AWZ Screen Recorder
AWZ Screen Recorder ...zevish — 11:05
Website X5 Go 2024.1
Website X5 Go 2024.1...zevish — 09:32
Apple's rules to allow third-party app ...
Apple has announ...alison30 — 09:28
Intel: Microsoft AI PCs need a Copilot K...
Microsoft hopes th...harlan4096 — 08:55
Synchredible 8 Professional Edition v8.2...
          Synchredib...zevish — 08:54

[-]
Birthdays
Today's Birthdays
No birthdays today.
Upcoming Birthdays
No upcoming birthdays.

[-]
Online Staff
There are no staff members currently online.

>