4 ms·
Malware embedded into audio driver is silently recording from system mic
- treetalker 11mo agohttps://xcancel.com/Officialwhyte22/status/1995024999934001602 https://xcancel.com/Officialwhyte22/status/19950249999340016...
- jacquesm 11mo agoThat's an OVH Singapore IP, did they flag this to OVH? That server should be taken offline and the contents preserved for forensics.
- monerozcash 11mo agoThey're analysing a file from 2012, OVH probably didn't even own those IPs back then.
- jacquesm 11mo agoSo this whole post is BS then.
- bri3d 11mo agoI’m not sure this isn’t just some garden variety RAT that was named “audiod.exe”? The author seems kind of confused; there’s nothing driver related I can see here. They claim the malware was “injected” into a legitimate process, but the Microsoft audio graph process is “audiodg.exe”
- fishgoesblub 11mo ago"compressed .wav files" Interesting that the malware author isn't using actual compressed audio (No idea why the Twitter poster seems to think wave files are compressed) I would assume that you'd want to transmit as little data to evade detection.
- irilesscent 11mo agoI think its more resource intensive to record a more optimised format.
- RossBencina 11mo ago.wav files are RIFF containers of type 'WAVE'. These files can contain many different types of RIFF chunks, but the required chunks are a 'fmt ' (format information) and 'data' (audio payload). The format chunk describes the encoding of the audio payload data, among other information (channel count, sample rate).[0] Although .wav files are, today, typically used for non-compressed PCM data (WAVE_FORMAT_PCM), even the original 1991 RIFF specification allowed for three compressed formats: mu-law, a-law, ADPCM.[1] These are all efficient to compute and I don't find it completely implausible that such low quality compression would be used. Modern .wav files may use the WAVEFORMATEX or WAVEFORMATEXTENSIBLE chunk, which uses GUIDs to identify formats. It supports the original compressed WAVE formats,[2] but also more modern compressed formats. Here is For example, here is Microsoft's list of sub-format GUIDs (includes MPEG formats and AC-3): https://learn.microsoft.com/en-us/windows-hardware/drivers/audio/subformat-guids-for-compressed-audio-formats https://learn.microsoft.com/en-us/windows-hardware/drivers/a... [0] https://en.wikipedia.org/wiki/WAV https://en.wikipedia.org/wiki/WAV [1] https://www.aelius.com/njh/wavemetatools/doc/riffmci.pdf https://www.aelius.com/njh/wavemetatools/doc/riffmci.pdf heading "WAVE Format Categories". [2] https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ksmedia/ns-ksmedia-waveformatextensible https://learn.microsoft.com/en-us/windows-hardware/drivers/d...
- jml7c5 11mo agoAccording to the vx-underground Twitter account, this is just Regin (which was first described in 2014): https://x.com/vxunderground/status/1995309917805179141 https://x.com/vxunderground/status/1995309917805179141 https://en.wikipedia.org/wiki/Regin_(malware) https://en.wikipedia.org/wiki/Regin_(malware)
- ashleyn 11mo agoWell at the very least he confirmed Regin continues to circulate.
- unsnap_biceps 11mo agoHe hasn't actually confirmed that the image he's processing is recent or if it was a test image and by "I found", he means he was able to find the thing that was known to be there. The Twitter thread has some people asking for clarification and none have been received yet.
- bri3d 11mo agoI’m not even convinced the audiod thing is Regin; whatever is going on is way less sophisticated even based on what the OP posted from volatility. I don’t think the hash they gave vx-underground is even from the sample from the original screenshots. I think this person is just karma/clout farming badly and the screenshots are of some even more basic RAT.
- efilife 11mo agoI quickly skimmed at through twitter and youtube profiles and it's apparent that this guy has no idea of what he's talking about
- ugh123 11mo agoI actually get that impression too. There's a surprising lack of detail for what he's trying to announce as a major exploit and feat of discovery.
- irilesscent 11mo agoWhat makes me suspect them the most was the fact that they use pure neon green text on black as their tty color. (seriously who does that?)
- efilife 11mo agolol the amount of typos here is abysmal, I must have been half-asleep
- snorbleck 11mo agoyou'd think the whole "micmon.dll" reference would give it away...