TrojanDownloader:Win32/Reconyc is a highly obfuscated, persistent trojan designed specifically to breach endpoint defenses and securely deliver secondary, high-severity payloads such as ransomware, banking trojans, and botnet agents.
Understanding Reconyc
To an end-user, a Reconyc infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Reconyc is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.
Execution and Evasion Strategies
Reconyc is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the %Temp% directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Reconyc frequently injects its downloading routine into legitimate system processes (like explorer.exe or svchost.exe) to mask its outbound network traffic.
Indicators of Compromise (IoCs)
Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Reconyc reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named, highly entropic binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested.
Observed techniques used by this family, mapped to the MITRE ATT&CK framework:
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
rule MALWARE_WIN_RECONYC {
meta:
description = "Detects Reconyc (trojan_generic)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "reconyc" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}title: Suspicious Reconyc Activity
id: 22bf0267d05ad55de9726391553c2174
status: experimental
description: Detects generic indicators of the reconyc malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*reconyc*"
condition: selection
level: mediumOrdered checklist for responders. Adapt to your environment and engage professional support for active incidents.
Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.
Explore other malware families in the same category:
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/reconyc.json
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Replit, StackBlitz, CodeSandbox, and CodePen.