File scan report
Verdict Safe
Is zz_
No antivirus engine flagged the Python script and sandbox behaviour was benign.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Treat the script as safe for controlled testing; monitor any outbound connections and keep security software active.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 60 flagged
- Flagged 0
- No detection 60
- No result 15
- Code signing Not applicable
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
1 point against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Zero detections across 75 engines, one sandbox run showed only system-info discovery, and no external-intel hits. The single rule on direct-IP traffic is inconclusive without host reputation data.
The file is a Python script with medium prevalence. All 75 reporting engines returned clean, including 16 major antivirus engines. Sandbox execution produced only routine system-information calls and no malicious verdict. The triggered rule notes direct-IP traffic but explicitly states it is not decisive without further correlation. No external-intel sources corroborate malice.
What We Detected
75 engines scanned the 20 kB Python file; none returned a malicious or suspicious label. Sandbox execution logged only T1082 system-information discovery and wrote to pseudo-terminals, typical of normal script execution.
Threat Behavior
No offensive MITRE techniques, no files it created, no persistence indicators. Two direct IP addresses were contacted, but the rule-based rule itself cautions against treating this as a control server without host-reputation confirmation.
What To Do Now
The file can be executed in a controlled environment if needed; keep security software enabled. If the script is required for legitimate work, verify its source and review the code before broader deployment.
Where this verdict could be wrong1 caveat
- contactedHosts is null — no complete host-reputation result available for the two observed IPs.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- zero malicious detections across 75 engines
- sandbox returned no malicious verdict
- medium prevalence with consistent submissions
- contactedHosts cross-check incomplete
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 1sandbox rule tag
- 4spawned processes
- 2network contacts
- 4filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
1MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1082· System recon
Observed activity
Processes started
4Programs the file ran, with their command lines.
xtermxterm -hold -e /usr/bin/python /tmp/file.pypython/usr/bin/python /tmp/file.pypy.exe"C:\Windows\py.exe" "C:\Users\user\Desktop\sample.py"python.exeC:\Users\user\AppData\Local\Programs\Python\Python313\python.exe "C:\Users\user\Desktop\sample.py"
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
185.125.188.58 - IP address
185.125.188.54
Files
4Files the file created, changed or deleted.
- Written
/dev/tty - Written
/dev/ptmx - Written
/dev/pts/0 - Written
\Device\ConDrv\\Connect
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Chapter 04
Technical details
None of the 60 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 23, 2026, 4:34 AM UTC
- SHA-256
52cae47ec10b4bf15a899032f95ea91163eac9ea1d00966485a3c8280cb892de- SHA-1
410062961613458d2e159a14637af31613fb08e4- MD5
d4b37cca423c046218aeea22e809cc18
About this file
zz_2in1_Unlocker_0.12.0.rpy is a Python file of 20.6 kB.
- Type and size
- Python · 20.6 kB
- Signer
- Not applicable
- First seen
- Aug 8, 2026On VirusTotal.
- Submitted by
- 8 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 60 engines flagged this file
15 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-232 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is zz_2in1_Unlocker_0.12.0.rpy safe?
What is zz_2in1_Unlocker_0.12.0.rpy?
How many antivirus engines detected zz_2in1_Unlocker_0.12.0.rpy?
What is the SHA-256 hash of zz_2in1_Unlocker_0.12.0.rpy?
Is it safe to open zz_2in1_Unlocker_0.12.0.rpy?
How up to date is this analysis of zz_2in1_Unlocker_0.12.0.rpy?
Community
Member reviews and reports for this exact file hash.