QuirkyLoader: A Silent Enabler of Modern Malware Families
Summary
QuirkyLoader is a stealthy malware loader first discovered in November 2024, spreading worldwide through phishing emails carrying malicious archive files. Once executed, it leverages DLL side-loading and process hollowing to inject encrypted payloads into trusted Windows processes. This makes it a powerful delivery mechanism for malware such as Snake Keylogger, Remcos, AsyncRAT, FormBook, MassLogger, and Agent Tesla. Recent campaigns in Taiwan and Mexico demonstrate its role as a critical enabler of modern cybercrime, supporting both targeted and widespread infections.
Attack Details
QuirkyLoader operates as a malware delivery system designed to expand the scope of attacker operations. Infection typically begins with a phishing email containing a malicious archive that bundles:
- A seemingly harmless executable
- An encrypted payload
- A hidden DLL to power execution
Once triggered, QuirkyLoader activates the DLL, which injects malicious code into trusted Windows processes like AddInProcess32.exe, InstallUtil.exe, and aspnet_wp.exe. This masking technique hides malicious activity under legitimate processes.
Technically sophisticated, QuirkyLoader’s DLL module is built in C#.NET with Ahead-of-Time (AOT) compilation, making it resemble traditional C/C++ binaries and evade .NET-based detection. Payloads are handled via Win32 APIs and decrypted using block ciphers, with some variants employing the Speck-128 cipher in CTR mode.
The loader dynamically resolves APIs for stealth, creates suspended processes, replaces memory with malicious payloads, and resumes execution. In real-world campaigns (July 2025), attackers used QuirkyLoader to deliver Snake Keylogger in Taiwan and Remcos RAT/AsyncRAT in Mexico, with infrastructure tied to a Zimbra web client domain using a legitimate SSL certificate.
Recommendations
- Be Cautious with Email Attachments – Do not open unexpected ZIP or RAR files, even from known contacts. Verify suspicious messages via alternate channels.
- Restrict Scripting & Admin Tools – Limit and monitor use of Windows tools like InstallUtil.exe, often hijacked by QuirkyLoader.
- Monitor Domains & SSL Certificates – Watch for unusual domains with valid SSL certificates being used to distribute malware.
- Enhance Endpoint Security – Deploy NGAV and EDR solutions with behavioral detection and machine learning to block advanced loaders.
Indicators of Compromise (IoCs)
- SHA256 Hashes (samples):
- 011257eb766f2539828bdd45f8aa4ce3c4048ac2699d988329783290a7b4a0d3
- a64a99b8451038f2bbcd322fd729edf5e6ae0eb70a244e342b2f8eff12219d03
- d954b235bde6ad02451cab6ee1138790eea569cf8fd0b95de9dc505957c533cd
- b22d878395ac2f2d927b78b16c9f5e9b98e006d6357c98dbe04b3fd78633ddde
- bf3093f7453e4d0290511ea6a036cd3a66f456cd4a85b7ec8fbfea6b9c548504
- 8e0770383c03ce69210798799d543b10de088bac147dce4703f13f79620b68b1
(full list in advisory)
- Domains:
- catherinereynolds[.]info
- mail[.]catherinereynolds[.]info
- IPv4 Addresses:
- 157[.]66[.]22[.]11
- 103[.]75[.]77[.]90
- 161[.]248[.]178[.]212
MITRE ATT&CK TTPs
- Tactics: Initial Access (TA0001), Execution (TA0002), Defense Evasion (TA0005), Command and Control (TA0011)
- Techniques:
- Phishing (T1566), Spearphishing Attachment (T1566.001)
- User Execution (T1204)
- Hijack Execution Flow (T1574), DLL Side-Loading (T1574.001)
- Obfuscated Files or Information (T1027)
- Process Injection (T1055), Process Hollowing (T1055.012)
- System Binary Proxy Execution (T1218), InstallUtil Abuse (T1218.004)
- Application Layer Protocol (T1071), Web Protocols (T1071.001)
.svg)