CyberRaiju @jaiminton.com · Apr 22 Another notable Octowave Loader sample with installer MSI showing low VT hits, and malicious DLL's being completely undetected. Sideloads into the legitimate Audacity. Installs itself as 'Directory Converter' in the user LocalAppData 'Programs' directory. 👇
2 likes 2 replies
?
Replies
Likely from a fake Cloudflare challenge. Has 4 malicious DLLs, a Progress.pak supporting file, and shellcode inside of Presentations\Application.wav Deploys LummaC2 into memory which is now using both Telegram channel and Steam Community names for C2 fallback. 👇
Another Octowave for the win!