Extracted

• • Target

    WhatsApp/WhatsApp.exe

  • Size

    700.0MB

  • MD5

    eed6f462fa1726e08e0484b390ca06b0

  • SHA1

    8e70784980600025bbc4fa69498e001c65455a8e

  • SHA256

    658b0fd44002ad353d0cf9cb604e9b8cfcad04a3d221c5133bcf6872bca73577

  • SHA512

    af67542f607afbe0f00de61c4d672b2736a375bd484d445cdd4c1e76407467babdb633849f16bbe411cd87f4194ba4024cdca82a1f8d58339c10d4c972903b9e

  • SSDEEP

    12288:Fwe20JjM2oJNVmnWZQzjFeM6DJOjB9sTTHyW8PCVmGZqfOTP/cBtApi2b3r:FnRqVmnYQb6VOKyKg6b3r

  Score

  10^/10

  redlinews-30infostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2