SynkLoader: MSI Masquerading as PowerShell Cleaner Drops Staged Payload

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•0

Detects the execution of a malicious MSI installer file named '331.msi' masquerading as a 'PowerShell Cleaner' utility. The rule monitors for the execution of this MSI package and the subsequent staging of suspicious files, specifically 'cleaner.ps1' and 'archive6.zip', within the '%LocalAppData%\PowershellCleaner\script\' directory.