A new threat targeting Borland Delphi Compilers is fast becoming a global concern, as we have been receiving reports of increased infection incidents. The file infector, detected by Trend Micro as PE_INDUC.A, tampers with Borland Delphi Compilers installed in targeted systems, causing all files compiled using the compromised Delphi compiler to be infected. Borland Delphi Compiler is a tool used to compile several popular enterprise database and desktop applications.

Upon execution, the malware checks if a Borland Delphi Compiler is installed on the system by checking a certain registry entry. Once the existence of the said compiler on the system is confirmed, it modifies the file SysConst.pas, by appending code. Through this routine, it compiles a new copy of the file SysConst.dcu which is detected by Trend Micro as TROJ_INDUC.AA. It then renames the original SysConst.dcu to SysConst.bak and deletes the modified SysConst.pas.

Once done, all files compiled using the affected Delphi compiler are also infected. This puts other users at risk of getting affected by the same malware: if they happen to run a Delphi program that was compiled using a tampered Borland Delphi Compiler, then their own Borland Delphi Compiler will be tampered with as well.

As of this time, there is no known payload for this malware except for infecting the compiled files.

Trend Micro Japan threat analysts have written an entry on this threat here. We will be updating this entry as more information comes in.

If you're new here, you may want to subscribe to our RSS feed. Thanks for visiting!

While still low-intensity compared to the PC platform, malware attacks against Macs are definitely becoming more prevalent. Trend Micro researcher Ivan Macalintal has found another new variant of the JAHLAV family hosted on known malicious domains. The new variant is detected as OSX_JAHLAV.I and, like other JAHLAV variants, poses as pirated versions of legitimate applications and modifies the system’s DNS settings, allowing malicious users to be victimized by phishing attacks, or surreptitiously redirecting them to sites which might harbor malicious exploits .

Unlike the earlier variants which only posed as versions of QuickTime, this one also poses as pirated versions of Foxit Reader and several antivirus applications. In addition, like the June variant of JAHLAV—OSX_JAHLAV.B—at least one website hosting OSX_JAHLAV.I could also deliver malware onto Windows systems, although the said file is no longer available from the said website.

Both Mac and Windows users are protected by the Smart Protection Network against this threat, as the websites involved are already blocked and the malicious files are detected as noted above.