Extracted

Extracted

• • Target
    UnlockToolPro 18.12.2025 Released Update !.zip
  • Size 163.8MB
  • SHA256 2edecefe286a94872ea11b3b662f58d99ced2e120a740a254025bdb481f39347
  • MD5 a839a57e356cbd7678eb444bf34f9a36
  • SHA1 0077acbce3c4b4b6c4e41f33fe11a4c09aa0db1b
  • SHA512 88176a0adc05466c6ccb27707a1027b58acef15d635a018e00170d292576ac5d59048913af582fbc28f61020d6937e2fddaa0a418a1ce196dabc6fe449ed58eb
  • SSDEEP 3145728:DjqDAga/1vt14kG+eej66od9HmTEA40yX4haLVMwsIYqx6txX6iDUVTP8fFI+/zf:DGDA7/XmYeejZcn70UjZfhv6t54jQ
  • TLSH
    T18E883316500FB09335B9F5674F52F13278E5D4386FBE815EE3BA060228CAFA81AD951F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    PASSWORD UNLOCKTOOLPRO.txt
  • Size 23B
  • SHA256 01ba993b65e8dafd0f1a501b7b3623c79c04ace661d62e862f55127e2cf1dbb4
  • MD5 cc85030a2f464cd23381806e51249377
  • SHA1 ca9faecab6df46bb21ac8139f5d8b272b042cf14
  • SHA512 ab0cc1b650e1581b8abbe9bb1edaeecbd85242f01370db7660ef33695b7f8a54910d5bfec24ed1d45157298318446fd74bcaabe67010b87b3e348a8afd56a4f6
  • MD5 SHA1 SHA512

  Score

  3^/10
  behavioral2
• • Target
    UnlockToolPro 18.12.2025.zip
  • Size 163.8MB
  • SHA256 16ced02c0732f1dd3b103ee2fa9906470c6cddc103b89d78d60a68c5cff7a2d0
  • MD5 ed6b3847ab81ff425585007442572a77
  • SHA1 36e6434df48121cd99b41d9899df2d03c773ad63
  • SHA512 4b9328d41510c31a377ca95a12d93d32d0dad51f895d6d96e9a627d1a58148470d32829effd5894a74c536f2126719017298a7fd69fb7a1556005c955b52dd0c
  • SSDEEP 3145728:7jqDAga/1vt14kG+eej66od9HmTEA40yX4haLVMwsIYqx6txX6iDUVTP8fFI+/zE:7GDA7/XmYeejZcn70UjZfhv6t54jB
  • TLSH
    T114883316500FB09335B9F5674F52F13278E5D4386FBE815EE3BA060228CAFA81AD951F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3
• • Target
    UnlockToolPro 18.12.2025.exe
  • Size 164.1MB
  • SHA256 c9e31542663da41bea0255edd0b82ee0e64610131a24e2c8bb5d9e70c633abdb
  • MD5 011c7f7c57ec524c9fe82a2071733196
  • SHA1 e2864d34a214a55431bafd1f65bee94f094f02a3
  • SHA512 044f1e3138f557edda2b97a1a543725845cdd9799869285c9a9e5585b4f05906c211991140e0cbb559297145c8b1e7b6ee75397bf04bb27cf617ce04b99132fe
  • SSDEEP 3145728:zFwvlWee5iSLPJpW4ibr6I2PiY7V/14rJEfkZRvvMUuSdL:7ee5iSNw4ibr1ja6rkKRwy
  • TLSH
    T1CF8833D869405D66D5078C74C89B1F87D356EEDCAA39740E3A32F6981A3FBE22D00376
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionfuerygcleanerinstallerloaderprivilege_escalationspywarestealertrojanupx

  • Fuery

    Fuery is a trojan written in Delphi.

    trojanfuery

  • Fuery family

    fuery

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral4