Loading malware…
QuirkyLoader is a malware loader active since at least November 2024 that has been used in email-driven campaigns to deliver a range of follow-on payloads, including remote access trojans, information stealers, and keyloggers. Observed payloads associated with QuirkyLoader include Agent Tesla, AsyncRAT, FormBook, MassLogger, Remcos, Rhadamanthys, and Snake Keylogger.
The infection chain begins with phishing or spam emails carrying a malicious archive attachment. The archive typically contains a legitimate executable, a malicious DLL, and an encrypted payload. Execution relies on DLL sideloading: the legitimate executable loads the malicious DLL, which then loads and decrypts the embedded payload and injects it into another process. Reported process injection behavior includes process hollowing into legitimate Windows processes. The loader module has been observed as a .NET implementation compiled ahead of time into native code, which can make it resemble a conventional C or C++ binary and complicate analysis.
QuirkyLoader is primarily a delivery mechanism rather than the final payload itself, enabling post-compromise deployment of commodity malware families used for credential theft, surveillance, and remote control. Campaign reporting has linked its use to broad spam activity and to targeting in countries including Taiwan and Mexico. The malware targets Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Email-delivered malware loader used to distribute multiple second-stage payload families (stealers/RATs/keyloggers).
Email-delivered loader used to distribute multiple second-stage payloads (e.g., Agent Tesla, AsyncRAT, Formbook, Masslogger, Remcos RAT, Snake Keylogger) since at least Nov 2024.
Referenced as a similar loader family to a newly observed loader variant used in this campaign; the observed loader uses DLL sideloading, persistence via Run key, and in-memory loading of the PureRAT assembly via AddInProcess32.exe.
QuirkyLoader is a malware loader active since late 2023, used to deliver remote access trojans (RATs) and infostealers in various campaigns.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.