PowerShell Decompressing Payload Disguised as Subtitles (AsyncRAT)

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•6

Identifies PowerShell dynamically decompressing a payload disguised as a file named 'Subtitles', which is a known technique used by AsyncRAT.