This rule identifies executable files compiled with Borland Delphi or Microsoft Visual C++ that exhibit specific characteristics associated with the FSG 120 family, potentially indicating the presence of legacy or obfuscated malware payloads. Proactively hunting for these artifacts helps the SOC detect low-severity threats that may leverage common development frameworks to blend in with legitimate software, reducing the risk of undetected persistence or lateral movement within the environment.
rule FSG_120_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp: PEiD
{
strings:
$a = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }
condition:
$a at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
.exe files contain specific Delphi runtime library signatures that match the YARA rule, even when the application is a standard internal tool.
C:\Dev\Projects\, D:\Builds\) or exclude files with extensions like .dproj or .pas in the same directory. Alternatively, whitelist known build server IPs or computer names associated with the development team.C:\Program Files (x86)\ or C:\Program Files\ and are executed by service accounts or user sessions, triggering the detection on the binary itself.
C:\Program Files\LegacyERP\, C:\Program Files (x86)\OldInventorySystem\). Ensure the exclusion is scoped to the specific executable name (e.g., LegacyApp.exe) rather than the entire folder to avoid over-exclusion.%TEMP%, C:\Windows\Temp) before execution. The YARA rule may scan these transient files during the staging process.
%TEMP%, `C:\