eb0bde9d13a68edfa11130a61ae1fbd5d54d91e52113addbbb911bda627dd848

Login
Reports

Overview

overview

Static

static

ReconXplor...te.zip

windows10-2004-x64

ReconXplor...te.zip

windows11-21h2-x64

ReconXplor...ll.bat

windows10-2004-x64

ReconXplor...ll.bat

windows11-21h2-x64

ReconXplor...ain.py

windows10-2004-x64

ReconXplor...ain.py

windows11-21h2-x64

ReconXplor...un.bat

windows10-2004-x64

ReconXplor...un.bat

windows11-21h2-x64

ReconXplor...310.js

windows10-2004-x64

ReconXplor...310.js

windows11-21h2-x64

ReconXplor...313.js

windows10-2004-x64

ReconXplor...313.js

windows11-21h2-x64

ReconXplor...314.js

windows10-2004-x64

ReconXplor...314.js

windows11-21h2-x64

ReconXplor...10.pyc

windows10-2004-x64

ReconXplor...10.pyc

windows11-21h2-x64

ReconXplor...13.pyc

windows10-2004-x64

ReconXplor...13.pyc

windows11-21h2-x64

ReconXplor...14.pyc

windows10-2004-x64

ReconXplor...14.pyc

windows11-21h2-x64

ReconXplor...10.pyc

windows10-2004-x64

ReconXplor...10.pyc

windows11-21h2-x64

ReconXplor...13.pyc

windows10-2004-x64

ReconXplor...13.pyc

windows11-21h2-x64

ReconXplor...14.pyc

windows10-2004-x64

ReconXplor...14.pyc

windows11-21h2-x64

ReconXplor...10.pyc

windows10-2004-x64

ReconXplor...10.pyc

windows11-21h2-x64

ReconXplor...13.pyc

windows10-2004-x64

ReconXplor...13.pyc

windows11-21h2-x64

ReconXplor...14.pyc

windows10-2004-x64

ReconXplor...14.pyc

windows11-21h2-x64

Analysis

max time kernel
149s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:11

Sharing

Copy URL Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

ReconXplorer-FinalUpdate.zip

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

ReconXplorer-FinalUpdate.zip

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

ReconXplorer-FinalUpdate/install.bat

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

ReconXplorer-FinalUpdate/install.bat

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

ReconXplorer-FinalUpdate/main.py

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

ReconXplorer-FinalUpdate/main.py

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

ReconXplorer-FinalUpdate/run.bat

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

ReconXplorer-FinalUpdate/run.bat

Resource

win11-20260513-en

windows11-21h2-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/auto_login.cpython-310.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

execution

Behavioral task

behavioral10

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/auto_login.cpython-310.js

Resource

win11-20260513-en

windows11-21h2-x64

1 signatures

150 seconds

execution

Behavioral task

behavioral11

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/auto_login.cpython-313.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

execution

Behavioral task

behavioral12

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/auto_login.cpython-313.js

Resource

win11-20260513-en

windows11-21h2-x64

1 signatures

150 seconds

execution

Behavioral task

behavioral13

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/auto_login.cpython-314.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

execution

Behavioral task

behavioral14

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/auto_login.cpython-314.js

Resource

win11-20260513-en

windows11-21h2-x64

1 signatures

150 seconds

execution

Behavioral task

behavioral15

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/badge_changer.cpython-310.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/badge_changer.cpython-310.pyc

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/badge_changer.cpython-313.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral18

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/badge_changer.cpython-313.pyc

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/badge_changer.cpython-314.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/badge_changer.cpython-314.pyc

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/email_info.cpython-310.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/email_info.cpython-310.pyc

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/email_info.cpython-313.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/email_info.cpython-313.pyc

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/email_info.cpython-314.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

9 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral26

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/email_info.cpython-314.pyc

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/get_ip.cpython-310.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral28

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/get_ip.cpython-310.pyc

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral29

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/get_ip.cpython-313.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral30

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/get_ip.cpython-313.pyc

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/get_ip.cpython-314.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral32

Sample

ReconXplorer-FinalUpdate/utils/__pycache__/get_ip.cpython-314.pyc

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target
ReconXplorer-FinalUpdate/run.bat
Size 84B
Sample260522-cmscqscv2q
SHA256 eb0bde9d13a68edfa11130a61ae1fbd5d54d91e52113addbbb911bda627dd848
MD5 e0f5684d7af64cf4bcc4a691288fa7a1
SHA1 05f26c98eaa632d0edd0481c849600e60c9992cc
SHA512 3702678a649bc26f8185b280a50855a906b4c7ea5e7f7b2619fd5d716b445161e0e2b7ed46e88ad3f9cf7646a61dc3a3524621cd74b4d98355ddae231ad15e03
TLSH
T1FDA02430110DD1D4CCF5544DC1415501004011337D517503FC3107F75CC1450D107F37
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3444	3668	cmd.exe	81
PID 3668 wrote to memory of 4480	3668	cmd.exe	82

Processes

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ReconXplorer-FinalUpdate\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=35
  2⤵
  PID:3444
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python main.py
  2⤵
  PID:4480

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads