QuirkyLoader: A Silent Enabler of Modern Malware Families

QuirkyLoader: A Silent Enabler of Modern Malware Families

Summary

QuirkyLoader is a stealthy malware loader first discovered in November 2024, spreading worldwide through phishing emails carrying malicious archive files. Once executed, it leverages DLL side-loading and process hollowing to inject encrypted payloads into trusted Windows processes. This makes it a powerful delivery mechanism for malware such as Snake Keylogger, Remcos, AsyncRAT, FormBook, MassLogger, and Agent Tesla. Recent campaigns in Taiwan and Mexico demonstrate its role as a critical enabler of modern cybercrime, supporting both targeted and widespread infections.

Attack Details

QuirkyLoader operates as a malware delivery system designed to expand the scope of attacker operations. Infection typically begins with a phishing email containing a malicious archive that bundles:

• A seemingly harmless executable

• An encrypted payload

• A hidden DLL to power execution

Once triggered, QuirkyLoader activates the DLL, which injects malicious code into trusted Windows processes like AddInProcess32.exe, InstallUtil.exe, and aspnet_wp.exe. This masking technique hides malicious activity under legitimate processes.

Technically sophisticated, QuirkyLoader’s DLL module is built in C#.NET with Ahead-of-Time (AOT) compilation, making it resemble traditional C/C++ binaries and evade .NET-based detection. Payloads are handled via Win32 APIs and decrypted using block ciphers, with some variants employing the Speck-128 cipher in CTR mode.

The loader dynamically resolves APIs for stealth, creates suspended processes, replaces memory with malicious payloads, and resumes execution. In real-world campaigns (July 2025), attackers used QuirkyLoader to deliver Snake Keylogger in Taiwan and Remcos RAT/AsyncRAT in Mexico, with infrastructure tied to a Zimbra web client domain using a legitimate SSL certificate.

Recommendations

1. Be Cautious with Email Attachments – Do not open unexpected ZIP or RAR files, even from known contacts. Verify suspicious messages via alternate channels.

2. Restrict Scripting & Admin Tools – Limit and monitor use of Windows tools like InstallUtil.exe, often hijacked by QuirkyLoader.

3. Monitor Domains & SSL Certificates – Watch for unusual domains with valid SSL certificates being used to distribute malware.

4. Enhance Endpoint Security – Deploy NGAV and EDR solutions with behavioral detection and machine learning to block advanced loaders.

Indicators of Compromise (IoCs)

• SHA256 Hashes (samples):

  • 011257eb766f2539828bdd45f8aa4ce3c4048ac2699d988329783290a7b4a0d3

  • a64a99b8451038f2bbcd322fd729edf5e6ae0eb70a244e342b2f8eff12219d03

  • d954b235bde6ad02451cab6ee1138790eea569cf8fd0b95de9dc505957c533cd

  • b22d878395ac2f2d927b78b16c9f5e9b98e006d6357c98dbe04b3fd78633ddde

  • bf3093f7453e4d0290511ea6a036cd3a66f456cd4a85b7ec8fbfea6b9c548504

  • 8e0770383c03ce69210798799d543b10de088bac147dce4703f13f79620b68b1
    (full list in advisory)

• Domains:

  • catherinereynolds[.]info

  • mail[.]catherinereynolds[.]info

• IPv4 Addresses:

  • 157[.]66[.]22[.]11

  • 103[.]75[.]77[.]90

  • 161[.]248[.]178[.]212

MITRE ATT&CK TTPs

• Tactics: Initial Access (TA0001), Execution (TA0002), Defense Evasion (TA0005), Command and Control (TA0011)

• Techniques:

  • Phishing (T1566), Spearphishing Attachment (T1566.001)

  • User Execution (T1204)

  • Hijack Execution Flow (T1574), DLL Side-Loading (T1574.001)

  • Obfuscated Files or Information (T1027)

  • Process Injection (T1055), Process Hollowing (T1055.012)

  • System Binary Proxy Execution (T1218), InstallUtil Abuse (T1218.004)

  • Application Layer Protocol (T1071), Web Protocols (T1071.001)

References

• IBM X-Force – QuirkyLoader Threat Analysis