Remcos RAT audio/webcam capture via waveInOpen and avicap32.dll

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects behavior indicative of the Remcos RAT, specifically the use of the Windows Wave API or avicap32.dll for silent audio and webcam recording, followed by the persistence of recorded files in the C:\MicRecords directory.