Encrypted ChaCha20-style POST beacon with random path tokens (SynkLoader)

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•3

Detects outbound HTTP POST requests characterized by an 'application/octet-stream' content type, a specific URI structure consisting of three components (20-40 characters, alpha-numeric, 20-40 characters), and an encrypted payload. This behavioral pattern is associated with SynkLoader malware command-and-control (C2) communications.