Resubmissions

16/06/2024, 18:21

240616-wzfn9avhrn7

16/06/2024, 17:48

240616-wdm67s1alg8

General

  • Target
    MTS_Remoteplay-install-win64.exe
  • Size 140.1MB
  • Sample240616-wdm67s1alg
  • SHA256 0b96d9af471c99a3672ca155220fc5cb453fc587ed69b68adc0d6d568af0a9d6
  • MD5 SHA1 SHA512 SSDEEP
Score
3/10

Malware Config

Signatures

  • Unsigned PE 82 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • MTS_Remoteplay-install-win64.exe
    .exe 140.1MB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 15KB
  • $PLUGINSDIR/NSIS.InstallOptions.ini
    687B
  • $PLUGINSDIR/StartMenu.dll
    .dll 7KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/UserInfo.dll
    .dll 4KB
  • $PLUGINSDIR/ioSpecial.ini
    211B
  • $PLUGINSDIR/modern-header.bmp
    9KB
  • $PLUGINSDIR/modern-wizard.bmp
    25KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • bin/7za.exe
    .exe 722KB
  • bin/GameMapper.db
    8KB
  • bin/ViGEmClient.dll
    .dll 141KB
  • bin/archive.dll
    .dll 685KB
  • bin/boost_atomic-vc143-mt-x64-1_82.dll
    .dll 17KB
  • bin/boost_chrono-vc143-mt-x64-1_82.dll
    .dll 35KB
  • bin/boost_container-vc143-mt-x64-1_82.dll
    .dll 53KB
  • bin/boost_context-vc143-mt-x64-1_82.dll
    .dll 14KB
  • bin/boost_coroutine-vc143-mt-x64-1_82.dll
    .dll 19KB
  • bin/boost_date_time-vc143-mt-x64-1_82.dll
    .dll 10KB
  • bin/boost_math_c99-vc143-mt-x64-1_82.dll
    .dll 33KB
  • bin/boost_math_c99f-vc143-mt-x64-1_82.dll
    .dll 33KB
  • bin/boost_math_c99l-vc143-mt-x64-1_82.dll
    .dll 31KB
  • bin/boost_math_tr1-vc143-mt-x64-1_82.dll
    .dll 168KB
  • bin/boost_math_tr1f-vc143-mt-x64-1_82.dll
    .dll 170KB
  • bin/boost_math_tr1l-vc143-mt-x64-1_82.dll
    .dll 168KB
  • bin/boost_random-vc143-mt-x64-1_82.dll
    .dll 30KB
  • bin/boost_regex-vc143-mt-x64-1_82.dll
    .dll 215KB
  • bin/boost_system-vc143-mt-x64-1_82.dll
    .dll 10KB
  • bin/boost_thread-vc143-mt-x64-1_82.dll
    .dll 73KB
  • bin/boost_url-vc143-mt-x64-1_82.dll
    .dll 279KB
  • bin/bz2.dll
    .dll 73KB
  • bin/charset-1.dll
    .dll 11KB
  • bin/chrome_100_percent.pak
    619KB
  • bin/chrome_200_percent.pak
    928KB
  • bin/chrome_elf.dll
    .dll 1.2MB
  • bin/concrt140.dll
    .dll 315KB
  • bin/crashpad_handler.exe
    .exe 563KB
  • bin/d3dcompiler_47.dll
    .dll 4.7MB
  • bin/datachannel.dll
    .dll 1.7MB
  • bin/dbghelp.dll
    .dll 1.9MB
  • bin/fmt.dll
    .dll 134KB
  • bin/gif.dll
    .dll 34KB
  • bin/iconv-2.dll
    .dll 1.0MB
  • bin/icudtl.dat
    9.7MB
  • bin/images/stub.png
    .png 3.6MB
  • bin/jpeg62.dll
    .dll 608KB
  • bin/legacy.dll
    .dll 89KB
  • bin/leptonica-1.83.1.dll
    .dll 2.6MB
  • bin/libEGL.dll
    .dll 419KB
  • bin/libGLESv2.dll
    .dll 2.6MB
  • bin/libcef.dll
    .dll 158.2MB
  • bin/libcrypto-3-x64.dll
    .dll 4.3MB
  • bin/libcurl.dll
    .dll 501KB
  • bin/liblzma.dll
    .dll 180KB
  • bin/libpng16.dll
    .dll 192KB
  • bin/libprotobuf-lite.dll
    .dll 527KB
  • bin/libprotobuf.dll
    .dll 2.4MB
  • bin/libprotoc.dll
    .dll 2.0MB
  • bin/libsharpyuv.dll
    .dll 21KB
  • bin/libssl-3-x64.dll
    .dll 535KB
  • bin/libwebp.dll
    .dll 360KB
  • bin/libwebpdecoder.dll
    .dll 154KB
  • bin/libwebpdemux.dll
    .dll 20KB
  • bin/libwebpmux.dll
    .dll 39KB
  • bin/libxml2.dll
    .dll 1.3MB
  • bin/locales/am.pak
    508KB
  • bin/locales/ar.pak
    539KB
  • bin/locales/bg.pak
    584KB
  • bin/locales/bn.pak
    749KB
  • bin/locales/ca.pak
    356KB
  • bin/locales/cs.pak
    363KB
  • bin/locales/da.pak
    329KB
  • bin/locales/de.pak
    361KB
  • bin/locales/el.pak
    636KB
  • bin/locales/en-GB.pak
    290KB
  • bin/locales/en-US.pak
    294KB
  • bin/locales/es-419.pak
    351KB
  • bin/locales/es.pak
    353KB
  • bin/locales/et.pak
    318KB
  • bin/locales/fa.pak
    513KB
  • bin/locales/fi.pak
    324KB
  • bin/locales/fil.pak
    364KB
  • bin/locales/fr.pak
    382KB
  • bin/locales/gu.pak
    723KB
  • bin/locales/he.pak
    447KB
  • bin/locales/hi.pak
    751KB
  • bin/locales/hr.pak
    350KB
  • bin/locales/hu.pak
    378KB
  • bin/locales/id.pak
    311KB
  • bin/locales/it.pak
    354KB
  • bin/locales/ja.pak
    426KB
  • bin/locales/kn.pak
    836KB
  • bin/locales/ko.pak
    355KB
  • bin/locales/lt.pak
    378KB
  • bin/locales/lv.pak
    378KB
  • bin/locales/ml.pak
    879KB
  • bin/locales/mr.pak
    .ps1 711KB
  • bin/locales/ms.pak
    326KB
  • bin/locales/nb.pak
    322KB
  • bin/locales/nl.pak
    331KB
  • bin/locales/pl.pak
    365KB
  • bin/locales/pt-BR.pak
    345KB
  • bin/locales/pt-PT.pak
    358KB
  • bin/locales/ro.pak
    358KB
  • bin/locales/ru.pak
    578KB
  • bin/locales/sk.pak
    369KB
  • bin/locales/sl.pak
    352KB
  • bin/locales/sr.pak
    547KB
  • bin/locales/sv.pak
    322KB
  • bin/locales/sw.pak
    334KB
  • bin/locales/ta.pak
    859KB
  • bin/locales/te.pak
    802KB
  • bin/locales/th.pak
    671KB
  • bin/locales/tr.pak
    342KB
  • bin/locales/uk.pak
    577KB
  • bin/locales/vi.pak
    407KB
  • bin/locales/zh-CN.pak
    298KB
  • bin/locales/zh-TW.pak
    294KB
  • bin/lz4.dll
    .dll 119KB
  • bin/miniupnpc.dll
    .dll 47KB
  • bin/msvcp140.dll
    .dll 561KB
  • bin/msvcp140_1.dll
    .dll 34KB
  • bin/msvcp140_2.dll
    .dll 262KB
  • bin/msvcp140_atomic_wait.dll
    .dll 49KB
  • bin/msvcp140_codecvt_ids.dll
    .dll 31KB
  • bin/opencv_calib3d4.dll
    .dll 2.1MB
  • bin/opencv_core4.dll
    .dll 3.3MB
  • bin/opencv_dnn4.dll
    .dll 4.1MB
  • bin/opencv_features2d4.dll
    .dll 773KB
  • bin/opencv_flann4.dll
    .dll 410KB
  • bin/opencv_highgui4.dll
    .dll 280KB
  • bin/opencv_imgcodecs4.dll
    .dll 323KB
  • bin/opencv_imgproc4.dll
    .dll 4.7MB
  • bin/opencv_ml4.dll
    .dll 542KB
  • bin/opencv_objdetect4.dll
    .dll 1.0MB
  • bin/opencv_photo4.dll
    .dll 631KB
  • bin/opencv_stitching4.dll
    .dll 746KB
  • bin/opencv_video4.dll
    .dll 657KB
  • bin/opencv_videoio4.dll
    .dll 579KB
  • bin/openjp2.dll
    .dll 345KB
  • bin/opus.dll
    .dll 389KB
  • bin/rds-aux.exe
    .exe 3.2MB
  • bin/rds-hooks-host-x64.exe
    .exe 221KB
  • bin/rds-hooks-host-x86.exe
    .exe 189KB
  • bin/rds-hooks-x64.dll
    .dll 134KB
  • bin/rds-hooks-x86.dll
    .dll 97KB
  • bin/rds-updater.exe
    .exe 192KB
  • bin/rds-watcher.exe
    .exe 103KB
  • bin/rds-wrtc.exe
    .exe 18.2MB
  • bin/resources.pak
    6.8MB
  • bin/resources/asset-manifest.json
    2KB
  • bin/resources/index.html
    .html 235B
  • bin/resources/library/asset-manifest.json
    2KB
  • bin/resources/library/index.html
    .html 225B
  • bin/resources/library/static/css/main.51727629.css
    20KB
  • bin/resources/library/static/css/main.51727629.css.map
    32KB
  • bin/resources/library/static/js/main.ee629007.js
    .js 204KB
  • bin/resources/library/static/js/main.ee629007.js.LICENSE.txt
    1KB
  • bin/resources/library/static/js/main.ee629007.js.map
    815KB
  • bin/resources/library/static/media/Accept.a86363cc05f782321584.svg
    941B
  • bin/resources/library/static/media/MTSCompact-Black.b34a12cc41caa2d9b151.woff2
    32KB
  • bin/resources/library/static/media/MTSCompact-Bold.dba5e9103f90ae432176.woff2
    29KB
  • bin/resources/library/static/media/MTSCompact-Medium.36c2e6be7399842f0466.woff2
    29KB
  • bin/resources/library/static/media/MTSCompact-Regular.b37f94f8a8cf0497ae85.woff2
    28KB
  • bin/resources/library/static/media/MTSSans-Black__W.18f8294157a8c60ae7ff.woff2
    29KB
  • bin/resources/library/static/media/MTSSans-Bold__W.4ee746071998651dde8d.woff2
    31KB
  • bin/resources/library/static/media/MTSSans-Medium__W.87dfef4a04bae3fd3dde.woff2
    30KB
  • bin/resources/library/static/media/MTSSans-Regular__W.61a1491eb2fb26a77277.woff2
    31KB
  • bin/resources/library/static/media/MTSSans-UltraWide__W.b9821f98b0f97829e3a7.woff2
    35KB
  • bin/resources/library/static/media/MTSWide-Black.a808dd3db9ed9cd1a4a6.woff2
    32KB
  • bin/resources/library/static/media/MTSWide-Bold.9e7e107b406a1728bcc0.woff2
    30KB
  • bin/resources/library/static/media/MTSWide-Light.2621a1fbf04fd706f2ff.woff2
    29KB
  • bin/resources/library/static/media/MTSWide-Medium.212f2c28e404c7c5dee7.woff2
    29KB
  • bin/resources/library/static/media/MTSWide-Regular.05512967c434c8a26ded.woff2
    29KB
  • bin/resources/library/static/media/button_a.f6b16ec621e3efcfa4c02d0fdd4a788e.svg
    1KB
  • bin/resources/library/static/media/button_x.0c8b86b3f79cce8be0e35d109e5f47bd.svg
    1KB
  • bin/resources/library/static/media/fail.dff3538aea686d5a1680e6104ffc415c.svg
    1KB
  • bin/resources/library/static/media/folder.0988416d67a7e1c484b4d85e99d45b3a.svg
    2KB
  • bin/resources/library/static/media/loader.47ddb9cdebc28b893b90.png
    .png 11KB
  • bin/resources/library/static/media/logo.333ff0f80d6b4225bc888186ff708c7a.svg
    358B
  • bin/resources/library/static/media/pencil.6cc7e89350feeb05f6f51d0a36da277d.svg
    2KB
  • bin/resources/library/static/media/plus.05c1443d4afd3e311eec6cf27505b63c.svg
    602B
  • bin/resources/library/static/media/qr2.0a075b2c50eac577fbf3f35df7a1cb0d.svg
    40KB
  • bin/resources/library/static/media/success.d91d9a90763654206ee6eecb292f0eab.svg
    1KB
  • bin/resources/library/static/media/trash.227f0b0a5b3b3ca0fedae152483ec5c5.svg
    3KB
  • bin/resources/library/static/media/user.d77f2ff81e1f8d9005d69f9b6ea81af7.svg
    1KB
  • bin/resources/notification/asset-manifest.json
    1KB
  • bin/resources/notification/index.html
    .html 303B
  • bin/resources/notification/static/css/main.54a62db6.css
    587B
  • bin/resources/notification/static/css/main.54a62db6.css.map
    1KB
  • bin/resources/notification/static/js/main.905537bd.js
    .js 213KB
  • bin/resources/notification/static/js/main.905537bd.js.LICENSE.txt
    1KB
  • bin/resources/notification/static/js/main.905537bd.js.map
    565KB
  • bin/resources/notification/static/media/MTSSans-Bold__W.4ee746071998651dde8d.woff2
    31KB
  • bin/resources/notification/static/media/MTSSans-Medium__W.87dfef4a04bae3fd3dde.woff2
    30KB
  • bin/resources/notification/static/media/MTSSans-Regular__W.61a1491eb2fb26a77277.woff2
    31KB
  • bin/resources/notification/static/media/alert.45bebfce5a21a2f85dfe8b6a95c35ca3.svg
    2KB
  • bin/resources/notification/static/media/gamepad.784155dcb4bf86fad465f35423cc86be.svg
    2KB
  • bin/resources/notification/static/media/hint.fb29f92ded6b2b9e0b5b28b952813f8f.svg
    5KB
  • bin/resources/notification/static/media/login.d9594a3c3abe4f0b41ad03be56d09134.svg
    2KB
  • bin/resources/notification/static/media/privacy.35f19ab82d6ca44ebfc9e6adbe02de50.svg
    2KB
  • bin/resources/notification/static/media/qrcode.4669448fd6d99e5bb69778ac526b699a.svg
    7KB
  • bin/resources/notification/static/media/save.d415e7811e64f11dad436aef5950bc8d.svg
    2KB
  • bin/resources/notification/static/media/time.716850b0e070a6ea4b76fcb6a98d3f38.svg
    1KB
  • bin/resources/notification/static/media/wait.eb513436c60aeb756e72371c64d8a628.svg
    2KB
  • bin/resources/static/css/main.1bba0e81.css
    935B
  • bin/resources/static/css/main.1bba0e81.css.map
    2KB
  • bin/resources/static/js/main.dd7c58ec.js
    .js 2.4MB
  • bin/resources/static/js/main.dd7c58ec.js.LICENSE.txt
    1KB
  • bin/resources/static/js/main.dd7c58ec.js.map
    2.8MB
  • bin/resources/static/media/MTSSans-Bold__W.4ee746071998651dde8d.woff2
    31KB
  • bin/resources/static/media/MTSSans-Medium__W.87dfef4a04bae3fd3dde.woff2
    30KB
  • bin/resources/static/media/MTSSans-Regular__W.61a1491eb2fb26a77277.woff2
    31KB
  • bin/resources/static/media/back.af7fd3e59e16f55b32b337e0faf0cdf2.svg
    1KB
  • bin/resources/static/media/checkmark.f19b0be9bad5ba41009bda2e3f00ada3.svg
    495B
  • bin/resources/static/media/circle-bg-pattern.8b0d7ef49e9e6356534f485ea9f35779.svg
    2.0MB
  • bin/resources/static/media/close.7f24a6f165dbca48112a5312af41bbc3.svg
    1KB
  • bin/resources/static/media/down-arrow.b038871cf153e08bc0dabb203bb64818.svg
    914B
  • bin/resources/static/media/important.b865e6d751d2dcec339fc898e67bc3c6.svg
    472B
  • bin/resources/static/media/info.20bb3923b00c093aaefec6eb89122f1f.svg
    782B
  • bin/resources/static/media/logo.c04f456b5d5fdcf3c2ccd9a391b509df.svg
    7KB
  • bin/resources/static/media/minimize.15b6e5ca74b25b2e7ba9389e890f9977.svg
    964B
  • bin/resources/static/media/play.1dcff7c5fc89fc5bab658b802fe57542.svg
    388B
  • bin/resources/static/media/settings.9fe66dbcb9b38e81a3fcfd417e527273.svg
    1KB
  • bin/resources/static/media/speed.41816668eebf03b33825685399cb37ac.svg
    1KB
  • bin/resources/static/media/stop.56eccd3d1df3df4eb87163e9173343c0.svg
    576B
  • bin/resources/static/media/tooltip.56608cf80d70ad5cebbd6359714e5797.svg
    4KB
  • bin/resources/static/media/waiting.54d6da58a8e2be157746b00ab6cc93ac.svg
    219B
  • bin/resources/static/media/warning.a37b755661ab17cb1bd77fd907ebaccb.svg
    1KB
  • bin/sentry.dll
    .dll 256KB
  • bin/snapshot_blob.bin
    50KB
  • bin/sounds/sound_check_mp3.wav
    22KB
  • bin/sqlite3.dll
    .dll 993KB
  • bin/tessdata/eng.traineddata
    3.9MB
  • bin/tessdata/rus.traineddata
    3.7MB
  • bin/tessdata/script/Cyrillic.traineddata
    27.9MB
  • bin/tessdata/script/Latin.traineddata
    85.2MB
  • bin/tesseract53.dll
    .dll 2.6MB
  • bin/tiff.dll
    .dll 447KB
  • bin/turbojpeg.dll
    .dll 681KB
  • bin/v8_context_snapshot.bin
    158KB
  • bin/vcruntime140.dll
    .dll 117KB
  • bin/vcruntime140_1.dll
    .dll 48KB
  • bin/vk_swiftshader.dll
    .dll 3.7MB
  • bin/vk_swiftshader_icd.json
    106B
  • bin/vulkan-1.dll
    .dll 698KB
  • bin/zlib1.dll
    .dll 87KB
  • bin/zstd.dll
    .dll 632KB
  • tmp/ViGEmBusSetup_x64.msi
    .msi 856KB

MTS_Remoteplay-install-win64.exe

  • IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
  • SHA256 0b96d9af471c99a3672ca155220fc5cb453fc587ed69b68adc0d6d568af0a9d6
  • MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest
c5:f9:18:b2:de:5d:ee:80:75:73:23:9c:86:ce:e6:04:fc:cd:95:83:6d:f5:ae:c5:a9:91:8a:0c:ee:88:ef:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=1027700149124,CN=ПУБЛИЧНОЕ АКЦИОНЕРНОЕ ОБЩЕСТВО МОБИЛЬНЫЕ ТЕЛЕСИСТЕМЫ,O=ПУБЛИЧНОЕ АКЦИОНЕРНОЕ ОБЩЕСТВО МОБИЛЬНЫЕ ТЕЛЕСИСТЕМЫ,STREET=ul Marksistskaya\, 4,L=Moscow,ST=Moscow,C=RU,1.2.840.113549.1.9.1=#0c0e706b697465616d406d74732e7275,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains

Jun 5, 2024

Minor OS version
0
Major OS version
4
Entry point
13559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths