← Back to SOC feed Coverage →

ThreatFox: QuirkyLoader IOCs

ioc-hunt HIGH ThreatFox
DeviceFileEvents
iocthreatfoxwin-quirkyloader
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-05T23:00:00Z · Confidence: high

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy the QuirkyLoader dropper to establish persistence and execute secondary payloads via three specific Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical because early detection of this loader prevents lateral movement and data exfiltration before the full malware chain activates.

IOC Summary

Malware Family: QuirkyLoader Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

TypeValueThreat TypeFirst SeenConfidence
sha1_hasha041d35efc838a8d88586c2ab38f3740b8f543d8payload2026-07-0595%
md5_hash23938cf31c1fa4700341cab81b0f3243payload2026-07-0595%
sha256_hash9df5a7b74fadadc12c289fff3f5c7f58e3893e5a36df8a287b1f69e588a7e818payload2026-07-0595%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - QuirkyLoader
let malicious_hashes = dynamic(["a041d35efc838a8d88586c2ab38f3740b8f543d8", "23938cf31c1fa4700341cab81b0f3243", "9df5a7b74fadadc12c289fff3f5c7f58e3893e5a36df8a287b1f69e588a7e818"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: QuirkyLoader IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Original source: https://threatfox.abuse.ch/browse/malware/win.quirkyloader/