AsyncRAT C2 TCP AES Handshake with Base64 Config Blob on Ports 6606/7707/8808

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the initial handshake communication pattern associated with AsyncRAT, characterized by a specific base64-encoded configuration blob sent to external non-standard ports (6606, 7707, 8808) as identified by the Snort rule logic.