They're analysing a file from 2012, OVH probably didn't even own those IPs back then.

I think its more resource intensive to record a more optimised format.

.wav files are RIFF containers of type 'WAVE'. These files can contain many different types of RIFF chunks, but the required chunks are a 'fmt ' (format information) and 'data' (audio payload). The format chunk describes the encoding of the audio payload data, among other information (channel count, sample rate).[0]

Although .wav files are, today, typically used for non-compressed PCM data (WAVE_FORMAT_PCM), even the original 1991 RIFF specification allowed for three compressed formats: mu-law, a-law, ADPCM.[1] These are all efficient to compute and I don't find it completely implausible that such low quality compression would be used. Modern .wav files may use the WAVEFORMATEX or WAVEFORMATEXTENSIBLE chunk, which uses GUIDs to identify formats. It supports the original compressed WAVE formats,[2] but also more modern compressed formats. Here is For example, here is Microsoft's list of sub-format GUIDs (includes MPEG formats and AC-3):

https://learn.microsoft.com/en-us/windows-hardware/drivers/a...

[0] https://en.wikipedia.org/wiki/WAV

[1] https://www.aelius.com/njh/wavemetatools/doc/riffmci.pdf heading "WAVE Format Categories".

[2] https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

I’m not even convinced the audiod thing is Regin; whatever is going on is way less sophisticated even based on what the OP posted from volatility. I don’t think the hash they gave vx-underground is even from the sample from the original screenshots.

I think this person is just karma/clout farming badly and the screenshots are of some even more basic RAT.

Well at the very least he confirmed Regin continues to circulate.

I actually get that impression too. There's a surprising lack of detail for what he's trying to announce as a major exploit and feat of discovery.

What makes me suspect them the most was the fact that they use pure neon green text on black as their tty color. (seriously who does that?)

lol the amount of typos here is abysmal, I must have been half-asleep