Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

AsyncRAT and Remcos delivered in an optimistic campaign

0
Medium
Published: 06/24/2026 (06/24/2026, 09:33:15 UTC)
Source: AlienVault OTX General

Description

A global phishing campaign targets business functions with emails carrying malicious Excel attachments that initiate a multi-stage infection chain when macros are enabled. The attack uses layered obfuscation, including HTA scripts, PowerShell, encoded payloads, and steganography in PNG files, to deliver and execute Remote Access Trojans such as Remcos and AsyncRAT in a largely fileless manner. It achieves scale and persistence through high variability, automation, disposable infrastructure, and consistent patterns that help evade detection despite relatively simple techniques.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 06/29/2026, 09:51:18 UTC

Technical Analysis

This campaign targets business functions worldwide through phishing emails containing malicious Excel attachments. When macros are enabled, the attachments trigger a multi-stage infection chain that uses heavy obfuscation methods, including HTA scripts, PowerShell commands, encoded payloads, and steganography embedded in PNG images, to deliver AsyncRAT and Remcos Remote Access Trojans. The attack is designed to be largely fileless, enhancing stealth and persistence. The campaign uses automation and disposable infrastructure to scale and evade detection despite using relatively simple techniques.

Potential Impact

Successful exploitation results in the installation of Remote Access Trojans AsyncRAT and Remcos, enabling attackers to gain unauthorized remote access to affected systems. This can lead to data theft, espionage, and further compromise of business environments. The fileless nature and obfuscation techniques complicate detection and response efforts.

Mitigation Recommendations

No official patch or vendor advisory is available for this campaign. Mitigation focuses on user awareness to avoid enabling macros in unsolicited Excel attachments, deploying advanced email filtering to block phishing attempts, and using endpoint detection solutions capable of identifying fileless and obfuscated attack techniques. Organizations should follow best practices for macro security and monitor for indicators of compromise related to AsyncRAT and Remcos. Patch status is not yet confirmed — check vendor advisories for updates.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
[]
Adversary
null
Pulse Id
6a3ba45b3fef31b3a05d9cb0
Threat Score
null

Indicators of Compromise

Ip

ValueDescriptionCopy
ip107.172.235.213
CC=US ASN=AS36352 colocrossing
ip198.12.83.75
CC=US ASN=AS36352 colocrossing
ip192.227.219.79
CC=US ASN=AS36352 colocrossing
ip173.231.188.244
CC=US ASN=AS29791 internap holding llc
ip107.172.135.60
CC=US ASN=AS36352 colocrossing

Url

ValueDescriptionCopy
urlhttp://192.227.219.79:4550
urlhttp://107.172.235.213/87/img_015059.png
urlhttp://173.231.188.244:14641
urlhttp://107.172.135.60/96/ibredgoodforbestthingscomingbackform.hta
e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9
urlhttps://as.al/file/KBn1RC
urlhttp://198.12.83.75/98/img_194618.png
urlhttps://cuth.me/sse8kU

Hash

ValueDescriptionCopy
hash614115669d093c58539e8183617a62a59aefd1a9a1fddcc7a67508f2fb9e36ab
hash0b47f8d79e37ebec7edd2333ab70caa1e3e710b310b8201c5447820886ce8d49
hash248da1553ce35bb6c499a660fcd92bde6e3545b56b65b63308e7b7630f376bfc
hash5e1172c07877a4d44f3c2f33abb268d7e6b3114e
SHA1 of 0b47f8d79e37ebec7edd2333ab70caa1e3e710b310b8201c5447820886ce8d49
hashce3480917a5285a03b9de320354f3e1b
MD5 of 0b47f8d79e37ebec7edd2333ab70caa1e3e710b310b8201c5447820886ce8d49
hashf9f6314fc9f333b1aa92afdd63a98927b85fd01607e907e69b4682d18f31d2a1
hash49c7b4eb6620917ee7ca796472b7af9f01ea6f7f80391ae7eb7bd8dabe0b7249
hash49c7b4eb6620917ee7ca796472b7af9f01ea6f7f80391ae7eb7bd8dabe0b7249
hash3e4dadbd55753a77a0d2acd3c333afc7
MD5 of 5e17e44fe2ef3e44904a65bfc787ddb9a5109350ce9636f4470f765e7f6fb1ec
hash492a0bda6b22583ccdab80b2b8f8f2a0
MD5 of a136fce65870643b187eada0d60d8b338a9f4d20762b2a550cadf03597f68017
hash52b725b8144745f2885198d514a805eb
MD5 of e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9
hash59ea75c5850eb80812d991f903a10014
MD5 of c92c8d5ea7e0e05e0f19fabd4111731ef4b9e7d5e0b028797e23481b6afde212
hash5e16dd79001f2faba4569e2abd5b19c0
MD5 of eb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8
hash5f51518947c84a2b43483ff3d5404cbd
MD5 of ef00251d4b7f56bf3a08afc6fbbbef268de470fb6d387e1c72909999a3b2c652
hash5fc03d7c710b3eb75a9c6534dd1319a7
MD5 of 7ffd8ab8cad744263a4f16c8e96da8b8c38818b480dbeaec91e4224ac70b7ec1
hash7351447d7eaf36822d9bce9ae0ed3ece
MD5 of f4d6b2437e33500195e3e1607704ffb7b544c2dd8f2333ed06d42d625b7a7f8d
hasha822b55a9a6a8b66c068d22e52d3203f
MD5 of 248da1553ce35bb6c499a660fcd92bde6e3545b56b65b63308e7b7630f376bfc
hashcd2a5eb1bf35cb53b20c75be741ac1f4
MD5 of ee4f710c68bc2214febeb0127ccb5e111e1a4d01f6d4503efd22a88fb1464606
hashd526c9bbc38129a8c81afeda08e9aaef
MD5 of 256f595afb005303a693fe26a03f9fce6d47b225bfc2300e418f5f80a89089d2
hashd924b7e4d3fc4bc02422057ebe87dcdd
MD5 of bb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3
hashf37382f028b294ec539f16b74af6a565
MD5 of c63b921b71be21eb964f085fa9d39dd720b183174ad40ec195b09b62f5ad2581
hash4c3f5e274c160b9943259754dbd23b3656aa8265
SHA1 of ef00251d4b7f56bf3a08afc6fbbbef268de470fb6d387e1c72909999a3b2c652
hash50fdee4b9ea69300c2769e613c92a69e4adcc0a8
SHA1 of 248da1553ce35bb6c499a660fcd92bde6e3545b56b65b63308e7b7630f376bfc
hash658af6cba07684a4d5a34547585430ddc37a6efa
SHA1 of a136fce65870643b187eada0d60d8b338a9f4d20762b2a550cadf03597f68017
hash6c2f10ec18c34ea9ba423b19e6ccf228ecf47a31
SHA1 of bb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3
hash8244d0a2457850ba4c2cc036d02863269272bdfd
SHA1 of 5e17e44fe2ef3e44904a65bfc787ddb9a5109350ce9636f4470f765e7f6fb1ec
hasha67a1b5cf32bcefab1d84c5eb09f3be808cbc4e1
SHA1 of f4d6b2437e33500195e3e1607704ffb7b544c2dd8f2333ed06d42d625b7a7f8d
hashb7cddd45bf477f1a2f8c4343f213454fe57f9b5f
SHA1 of ee4f710c68bc2214febeb0127ccb5e111e1a4d01f6d4503efd22a88fb1464606
hashcd3b3de6c894b9cd3bd3b9cfcf00077adb88877b
SHA1 of e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9
hashd044d5b8ba9c7abc203a0ff5688702c7f45b54cd
SHA1 of eb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8
hashe15c7f7f4f951bb444fe77603f903d601d3ad93b
SHA1 of 7ffd8ab8cad744263a4f16c8e96da8b8c38818b480dbeaec91e4224ac70b7ec1
hashe1f3942742b5cd393673539b3298fab5bdef7b14
SHA1 of c92c8d5ea7e0e05e0f19fabd4111731ef4b9e7d5e0b028797e23481b6afde212
hasheb4866afa868cfa18cb49a3bd62a7019358288d5
SHA1 of c63b921b71be21eb964f085fa9d39dd720b183174ad40ec195b09b62f5ad2581
hashf2dd12c3b7d04624433cc6811c6fbf20e3f84e2b
SHA1 of 256f595afb005303a693fe26a03f9fce6d47b225bfc2300e418f5f80a89089d2
hash0081bb2de5a6599ee14cba1d0df8ff7dd63fe8b070cd18dd7b11c2adfa5e7876
hash0542b57b67b021f877969c900214362d62eb2ba56d0645ab4e62838c8c79733a
hash0e1a306ac4b6770dbc8cb194021a9f32e9a726478db2e39084d4baa892c69521
hash0f2aa62136bee5996123b88a8a5216ad3822252ddb110c5e66728bd49ec270de
hash1982710eb67791c9c5ac55e13abad0c24d0210c1383eedbda20855944bfe75bd
hash1fcaa6fc864faa3b0964accf30c562fc4e9192e530c5c5bbcb5ee03fdfc46163
hash256f595afb005303a693fe26a03f9fce6d47b225bfc2300e418f5f80a89089d2
hash2d17adbea1ddca7e827c8e4b46d2ea7cb9e693aff07271e5fcb24765e8385afa
hash33ad6106da73526090d6a798951015b199fc4634b1a0ee611ca16ff32330eb06
hash38511e5189d3303d7258d3c889a61f56c5000fe4c91fbaedffc4271f6123038b
hash3892bcd10df0a5fdf2045f78609d073b89e0ef0ee88b88be6a9e308441a8c52c
hash3d8e5092a9852b61d8d45bd3c7e2d99907fcaa9a8fd3fe3b9efcbc9255947606
hash424d69145e60635da0d069aef4f2233db3468c557f01286af8e59e6aa8e5cd60
hash4f12ec57cca013dce1a5bcaf11ddf5d85fc2ecbc52afb9e61e4154d1be2d9ef3
hash5e17e44fe2ef3e44904a65bfc787ddb9a5109350ce9636f4470f765e7f6fb1ec
hash5e2c7496aed4efc11ae17641a6421ed47fea92342811026595dcee4f487180fb
hash6e79ef38577cca732976732c38ee22f5f3102a7a4458da6edb708b4be5afb9b0
hash7672fb55d63f3206cd694de6009288cc3d3aff7727233ca5a677072896308357
hash7ffd8ab8cad744263a4f16c8e96da8b8c38818b480dbeaec91e4224ac70b7ec1
hash8bc10f6462ac27eee0c685b74ffdf0554bd08d20b457543688ee82a86fdae275
hash975cf719a576788055ca2a6b7b44aaed36c27a8676ea8d50b25a9f935eaf9d79
hash97e74ad16c88b4b07722b5ad42dba95d837b6bdb9fa1193615f42fb34af5684f
hash9a4475ff6a370c3d958e40739b729ebbfae179f369ba26f2d12816066e951a7f
hash9c1121b62cc69945cde94f3f29022eb687216f61933904e5f32b902299a0399d
hash9f242f61a1f0cb29cbbce0f5c8412cb93ce48d1aa61968f7cc2539518425036f
hasha136fce65870643b187eada0d60d8b338a9f4d20762b2a550cadf03597f68017
hasha4ae487ec3b2db461067824c4c6753e26cf0a7b2b113d0c34a81b01c2c7b3c07
hashac7e72b5bf2dec4edf02545daf58342f60510f6d128509f47e52138c1f53cd38
hashacb18684468dc7c0b900e807758f4813115472011df161d7e05ff7beebbb5414
hashacdb202ced24988048597abfbcb288424882674d72abb77d693642a279bfc86d
hashb3d8e9daf02cc00d56bb2c1e1c380a68006d691f868cb6433d63f732085fbfde
hashb64b5e1c54fd1da11321cdcb320c0ddecda5be7060e98f0c032f90f0bed69eeb
hashb828d345b854f07e333f29bd5224ecb8d5daf0451a645b4be32e634395724c43
hashbb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3
hashbbbd65d1989023690b51f2a706e9a610e1ef598c10a0d33acf1774ff384a0f79
hashc63b921b71be21eb964f085fa9d39dd720b183174ad40ec195b09b62f5ad2581
hashc884b1e59bad0101ecf86bd1b5b9e0e2819d5c4d1bd6eac7d76da61db06baa73
hashc92c8d5ea7e0e05e0f19fabd4111731ef4b9e7d5e0b028797e23481b6afde212
hashd57cbb9f4a8176704f45b1c139990463907d293b74cfc2fdbe1656e304a94d22
hashdaa335553542dea9666a83b3f49e85b51193a39e809fd899bfcbc2d35fcc0c3e
hashe03a16696d74144a6ecb626662246332aa509d2d0ae7e2a192a3c8b1ed9390ea
hashe14539685087d21a47968ec6f07d7e6c385b8487fd7d0fbd635918f01d2f01ac
hashe1b29c075dcc880693a7fbe810e10d65b70a789e27c0d0254683c3eb172b9531
hashe38d9933364c69ceda6d80dda7ff12cfa3e3cf13b019af7264dbd263c3693874
hashe6318081f044c469c78245ecfc858c94542787564336f12a0f7cdef7aecc7a78
hashe6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9
hasheb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8
hashebfd6c01a834b160eb5b4456c04ba1d1b82fd28c99d9d1aa6b1a64c08929aa07
hashee4f710c68bc2214febeb0127ccb5e111e1a4d01f6d4503efd22a88fb1464606
hashef00251d4b7f56bf3a08afc6fbbbef268de470fb6d387e1c72909999a3b2c652
hashf028d7411d2507e887134cf74f3060460bbcfbc6afa4bb7bba16fb3d1507da74
hashf4d6b2437e33500195e3e1607704ffb7b544c2dd8f2333ed06d42d625b7a7f8d

Domain

ValueDescriptionCopy
domainffgfgjjddsgtrddhtjyfdsessxdssdfdfdfghfhg.duckdns.org

Threat ID: 6a423ca127e9c7971998234e

Added to database: 06/29/2026, 09:36:33 UTC

Last enriched: 06/29/2026, 09:51:18 UTC

Last updated: 06/30/2026, 00:20:20 UTC

Views: 18

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses