Introduction

QuirkyLoader Unveiled A Modular Malware Loader Delivering Multi-Payload Attacks presents a concise and detailed picture of a modular loader observed since November 2024. This investigation synthesizes technical analysis and campaign reporting to explain how quirkyloader operates as a loader that leverages dll-side-loading, process-hollowing, aot compiled dotnet components and a flexible payload catalog that includes agent-tesla, asyncrat, snake-keylogger, remcos-rat, formbook, masslogger and rhadamanthys-stealer. The following material integrates threat-intelligence from ibm-x-force and related research while preserving evidence on email-spam delivery, targeted-campaigns, memory-resident execution, native-like-binaries appearance and high-level implications for credential-theft, keystroke capture and data-exfiltration.