QuirkyLoaderMalware
According to X-Force, this is a loader module written in. NET languages for which ahead-of-time (AOT) compilation is used.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1055.012Process Hollowing
“PluginExecuting: Downloading and executing files, updating, uninstalling, in-memory execution (process hollowing/injection).”
- T1056.001Keylogging
“Its capabilities include remote user interface access (VNC-like), mouse and keyboard control, webcam and microphone capture, keylogging, file upload/download, traffic proxying, data exfiltration, and remote execution of commands or binaries.”
- T1555.005Password Managers
“Targeted theft modules: Collection of extensions, wallets, password managers, and 2FA authenticators (scanning known paths/applications).”
- T1684Social Engineering
“The email included a URL that ultimately led to the compromise of the victim machine through the ClickFix social engineering tactic.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Booking.com Phishing Campaign Targeting Hotels and Customers“It appears to operate like QuirkyLoader, a .NET loader compiled Ahead-of-Time (AOT).”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- rule[.]inin 1 report
- process[.]pidin 1 report
- action.properties[.]companyin 1 report
- d4845669f7f56c6c4eb82147a1f82615in 1 report
- 9bab404584f6a0d9…132fd145dd32in 1 report
- 799e73863806df2964d80d12ce4e61eain 1 report
- headkickscountry[.]comin 1 report
- activatecapagm[.]comin 1 report
- homelycareinc[.]comin 1 report
- byliljedahl[.]comin 1 report
- jamerimprovementsllc[.]comin 1 report
- seedsuccesspath[.]comin 1 report
- zenavuurwerkofficial[.]comin 1 report
- brownsugarcheesecakebar[.]comin 1 report
- hareandhosta[.]comin 1 report
- customvanityco[.]comin 1 report
- ctrlcapaserc[.]comin 1 report
- bknqsercise[.]comin 1 report
- bkngssercise[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.