MALICIOUS — 21450a32efcb56844cf4b6ef588bcfb995a4f7614bbe7c4115e698998889e61e.exe

MALICIOUS — 21450a32efcb56844cf4b6ef588bcfb995a4f7614bbe7c4115e698998889e61e.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AsyncRAT family. 7 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 21450a32efcb56844cf4b6ef588bcfb995a4f7614bbe7c4115e698998889e61e
SHA-1: 040b948b40cf289730349580206bf76bf2410c21
MD5: 229d98edecf5078345e555b81058c1a5
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 384:5gSVEEMiNPWmeOsVa/KFHbhMH9qbuUsUbQxnCJfJBndnjJsKI:5gSVXFg1VDHFiIbKBiBn9I
TLSH: T1F82D6CCC011E1FAAD933EE116460A6FE6851388AEC726F1C2F055A312754F33943766E
Submitted as: 21450a32efcb56844cf4b6ef588bcfb995a4f7614bbe7c4115e698998889e61e.exe
File type: pe · Size: 27136 bytes
Verdict: malicious (100/100) · Family: AsyncRAT

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (7 of 53 engines)

capa (capabilities): execute via PowerShell
YARA: Yara-Rules community: YR_AntiVM_Sandbox
Hash: abuse.ch ThreatFox: known-malicious-hash
Microsoft Defender: Backdoor:MSIL/AsyncRAT.AA!MTB
Emsisoft (Emergency Kit): Generic.AsyncRAT.Marte.B.B22962FC
Kaspersky (KVRT): HEUR:Backdoor.MSIL.Crysan.gen
Trellix Stinger (McAfee): Fareit-FZT!229D98EDECF5

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 6672) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Backdoor:MSIL/AsyncRAT.AA!MTB (rule Backdoor:MSIL/AsyncRAT.AA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.AsyncRAT.Marte.B.B22962FC (rule Generic.AsyncRAT.Marte.B.B22962FC) - engine signal, weight 0.55, confidence 0.85
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 3 external host(s) at runtime (2 HTTP) - network signal, weight 0.40, confidence 0.80
Contacted 3 external host(s) at runtime (2 HTTP) - network signal, weight 0.40, confidence 0.80
Extracted AsyncRAT config (0 C2) - engine signal, weight 0.45, confidence 0.60
Extracted AsyncRAT config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.35, confidence 0.70
query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

639 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded domains

f1681vn.com
glb.sls.prod.dcat.dsp.trafficmanager.net
reroute443.trafficmanager.net
staging.to-do.officeppe.com
s-0005.dual-s-msedge.net
teams.cloud.microsoft
outlook.cloud.microsoft
ln-0007.ln-msedge.net
glb.api.prod.dcat.dsp.trafficmanager.net
mr-b01.tm-azurefd.net
searchapp.bundleassets.example
settings-prod-uks-1-tagged.uksouth.cloudapp.azure.com
settings-prod-sea-2-tagged.southeastasia.cloudapp.azure.com
teams-mrc-ww-perf.tm-4.office.com
outlook.office.com
syd-efz.ms-acdc.office.com
outlook.office365.com
www.msftconnecttest.com
onedsblobvmssprdwus02.westus.cloudapp.azure.com
settings-prod-uks-2-tagged.uksouth.cloudapp.azure.com
onedscolprdeus16.eastus.cloudapp.azure.com
onedscolprdeus02.eastus.cloudapp.azure.com
onedscolprdeus07.eastus.cloudapp.azure.com
onedscolprdcus51.centralus.cloudapp.azure.com
onedscolprdeus05.eastus.cloudapp.azure.com

Embedded IP addresses

150.171.109.24
23.11.37.157
23.40.52.111

File paths

C:\new\Client\obj\Debug\F168APP.pdb

More AsyncRAT samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report