{
  "family": "delf",
  "sample_count": 1727,
  "category": "trojan_generic",
  "description": "<h3>Executive Summary</h3>\nDelf (often detected as Trojan.Delf) is a broad, generic classification used by antivirus engines to categorize a massive family of Trojans written in the Delphi programming language (specifically Borland Delphi). Because Delphi was highly popular among malware authors in the 2000s and early 2010s for its ease of creating Windows GUI applications and standalone executables, thousands of distinct malware variants fall under this generic \"Delf\" umbrella, ranging from simple password stealers to complex banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDue to the generic nature of the detection, the infection vectors are extremely varied. Delf variants are commonly distributed via malicious email attachments, P2P networks (disguised as keygens), or dropped by exploit kits.\n\nWhile specific capabilities vary by variant, Delf Trojans generally exhibit common malicious behaviors:\n<ul>\n<li><strong>Persistence Mechanisms:</strong> Almost all Delf variants establish persistence to ensure they run upon system boot, typically by copying themselves to the `C:\\Windows\\System32` directory and modifying the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key.</li>\n<li><strong>Information Theft:</strong> A large percentage of Delf malware acts as InfoStealers, aggressively searching for and extracting saved credentials from web browsers, FTP clients, and email software.</li>\n<li><strong>System Modification and Defense Evasion:</strong> Many variants attempt to disable the Windows Task Manager, Registry Editor, or specific antivirus processes to prevent the user from identifying and removing the threat.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Trojan.Delf detection must be treated with high severity. While it is an older classification, the underlying malware is designed to compromise the system, steal data, or provide remote access. The exact severity depends entirely on the specific, unclassified variant that has infected the machine.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation and Triage:</strong> Isolate the endpoint from the network. Utilize a modern Endpoint Detection and Response (EDR) solution to trace the execution path of the Delf executable to determine its exact capabilities (e.g., did it attempt to steal credentials or reach out to a C2 server?).</li>\n<li><strong>Registry and Startup Cleanup:</strong> Standard AV scans should remove the primary executable. However, IT administrators must verify that all associated persistent registry keys (Run keys, AppInit_DLLs) have been thoroughly cleaned to prevent re-infection upon reboot.</li>\n<li><strong>Credential Reset:</strong> Given that a vast majority of Delf variants act as credential stealers, it is highly recommended to perform a mandatory password reset for the compromised user account as a precautionary measure.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Delf",
    "Win32/Delf",
    "Malware.Delphi"
  ],
  "enrichment_level": "documented_reference_only",
  "faq": [
    {
      "@type": "Question",
      "name": "Where can I learn more about delf?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Refer to the linked MITRE ATT&CK technique pages, which document the behaviors associated with this family."
      }
    }
  ],
  "faq_count": 1,
  "mitre_attack": [
    "T1547.001",
    "T1555",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:47:42Z",
  "type": "Trojan (Generic Delphi)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}