BobSoftMiniDelphiBoBBobSoft

Hunt Hypothesis

This rule targets the presence of BobSoft MiniDelphi, a lightweight Delphi compiler often utilized by adversaries to create custom, obfuscated backdoors or droppers that may evade standard signature-based detections. Proactively hunting for this specific YARA signature allows the SOC team to identify low-severity, potentially stealthy malicious artifacts in memory or on disk before they are leveraged for lateral movement or privilege escalation.

YARA Rule

rule BobSoftMiniDelphiBoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 [4] E8 [4] 33 C0 55 68 [4] 64 FF 30 64 89 20 B8 }
	$a1 = { 55 8B EC 83 C4 F0 53 B8 [4] E8 [4] 33 C0 55 68 [4] 64 FF 30 64 89 20 B8 [4] E8 }
	$a2 = { 55 8B EC 83 C4 F0 B8 [4] E8 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: In environments where legacy line-of-business applications written in Delphi are distributed via Group Policy Object (GPO) software installation, the executable files (often named app.exe or similar) may be copied to the C:\Windows\Installer or user profile directories. Since these binaries are compiled with Delphi and may retain specific header signatures or string patterns, they can trigger the YARA rule.

  • Filter/Exclusion: Exclude files located in C:\Windows\Installer, C:\Program Files\BobSoft\, or C:\Users\*\AppData\Local\BobSoft\ if the file hash matches known good baseline hashes for the specific legacy application version.

• Development and Testing by Internal Teams: Developers or QA engineers working on internal tools or patches for BobSoft products may run debug builds or test executables directly from their local workstations or build servers. These binaries, especially if they are stripped of PDBs or contain specific debug strings, may match the YARA pattern.

  • Filter/Exclusion: Exclude processes or files where the parent process is a recognized IDE (e.g., dephi.exe, code.exe, visualstudio.exe) or where the file path resides within a designated development directory like C:\Dev\BobSoft\ or C:\Builds\.

• Scheduled Maintenance and Cleanup Jobs: Enterprise scheduled tasks (e.g., via Task Scheduler or cron on Linux gateways) that run BobSoft utility scripts or cleanup tools to manage logs or temporary files may execute Delphi-based helper executables. These utilities are often small, standalone binaries that match the “MiniDelphi” signature.

  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (for Task Scheduler) or cron/anacron (on