Grandoreiro Delphi SGC WebSocket DLL Side-Load from AppData\Local

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects artifacts and execution patterns associated with the Grandoreiro banking trojan. This includes the identification of known Embarcadero Delphi DLLs (mingwm10.dll, libwebp.dll, libffi-6.dll, libpng15.dll) being dropped into or loaded from AppData local directories, as well as wscript.exe or cscript.exe spawning suspicious executables from the same path, which is consistent with its VBS dropper chain.