Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
Varonis details AvisLoader, a Windows malware loader using ClickFix lures and Tox peer-to-peer command and control.
Varonis Threat Labs found AvisLoader, a Windows loader advertised on a cybercrime forum, on an exposed staging server with a ClickFix lure and its command center. The lure, hosted on Cloudflare Workers, impersonates a DocuSign request and asks visitors to paste a command that pulls code through a trycloudflare.com Quick Tunnel. The 3.4 MB 64-bit payload statically links c-toxcore and uses encrypted Tox peer-to-peer messaging for commands and file delivery, avoiding a fixed domain. Recovered files include shortcut persistence associated with VLCAssistant, a UACME method 41 helper using ICMLuaUtil, and hmn_hook.dll, which hooks NtQuerySystemInformation to filter process names.
- ClickFix page on Cloudflare Workers impersonates a DocuSign verification prompt.
- Loader uses Tox so operators can move command-and-control without a domain.
- Persistence modifies desktop and taskbar shortcuts via a VLCAssistant script.
- auto.exe references UACME method 41 and the ICMLuaUtil COM interface.
- Command center supports client tracking, shell tasks, and Tox file delivery.
- ATT&CK
- T1059 Command and Scripting InterpreterT1548.002 Bypass User Account ControlT1547.009 Shortcut ModificationT1036 MasqueradingT1573 Encrypted Channel
- Vendors
- Cloudflare
- Malware
- AvisLoader
- Organizations
- Varonis
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | trycloudflare.com | running the command. Investigate unfamiliar workers.dev and trycloudflare.com addresses when they appear in document-signing lures or com |
From the original article
5 min read at bleepingcomputer.com
A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. [...]
By Sponsored by Varonis · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.