SynkLoader ChaCha20 C2 beacon to hardcoded domains

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•1

Detects outbound HTTP POST requests to known SynkLoader C2 domains or URI patterns, characterized by 'application/octet-stream' Content-Type headers. The rule targets specific hardcoded domains used by the malware and a suspicious nested URI path pattern commonly associated with its beaconing behavior.