Micropsia

Executive Summary

Micropsia is a Windows remote access tool written in Delphi that creates persistence via legitimate mechanisms and communicates over HTTP(S) to a C&C server. It supports typical RAT features such as command execution, file transfer, and potentially keylogging, allowing attackers to maintain long‑term control of infected systems.

Micropsia is a Windows‑based Remote Access Tool (RAT) developed in Delphi. The codebase’s use of Delphi often results in compact binaries that can bypass basic anti‑virus heuristics, and the tool typically ships as a standalone executable without external dependencies. It is believed to be part of a broader family of RATs documented by multiple security researchers, including an analysis from Cisco Talos in 2017 and a subsequent report by Radware in 2018. Once executed on an infected host, Micropsia establishes persistence through legitimate Windows mechanisms such as registry run keys or scheduled tasks. It then communicates with its command‑and‑control (C&C) infrastructure over HTTP(S), allowing the attacker to issue commands that can enumerate system information, launch processes, and exfiltrate data from the victim machine. The malware’s Delphi origin often leads to obfuscated network payloads and encoded traffic which helps it evade signature‑based detection. While precise capabilities vary across samples, common behaviors observed in related Delphi RATs involve screenshot capture, keystroke logging, system shutdown commands, and file upload/download features. These functions combined with its lightweight footprint make Micropsia a persistent threat capable of lateral movement or data exfiltration from compromised environments.

Key Capabilities

• Establishes persistence through registry run keys or scheduled tasks
• Communicates with remote C&C servers via HTTP/HTTPS
• Executes arbitrary system commands and scripts
• Transfers files to and from the compromised host
• Captures system information (process list, services, network config)

ATT&CK Techniques

Recommended Actions

• Use endpoint protection that detects Delphi binaries and anomalous process behavior
• Block outbound traffic on uncommon ports to known malicious IPs or domains related to Micropsia C&C servers
• Monitor for persistence mechanisms such as new registry run keys or scheduled tasks created by unknown executables
• Perform regular system integrity checks on startup‑up items and auto‑run locations
• Update threat intelligence feeds to detect command patterns identified in Micropsia samples

Suggested Tags