SynkLoader Interactive RAT: pythonw.exe loads fake msvcp150.dll and beacons repeatedly

Ethan Andrews@eandrews

•updated Aug 24, 2026•9•0•18

Detects the SynkLoader RAT by identifying the pythonw.exe process loading a spoofed msvcp150.dll from a specific staging path (\fl\ang\), combined with correlative beaconing activity via repeated network connections to remote endpoints.