HEAVYGRAM Delphi .scr Dropper with Persian Lure Strings

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

Detects a Delphi-compiled Windows Screen Saver (.scr) file acting as a dropper. The binary contains embedded RCDATA ZIP resources and utilizes Persian-language filenames related to academic or student-focused lures to trick victims into execution. This rule specifically identifies the presence of the dropper's strings and the Borland Delphi marker.