SynkLoader fake msvcp150.dll RunPowerShell C# module

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•2

Detects a malicious DLL component associated with SynkLoader, identified by specific exported functions (RunPowerShell, ExecutePowerShellCommand) and assembly metadata that facilitate executing PowerShell commands directly in memory.