New Windows Malware Built to Survive Takedowns With a Hidden P2P Command Network
Varonis uncovers AvisLoader, a Windows loader using encrypted Tox P2P for takedown-resistant C2, delivered via ClickFix DocuSign lures.
Varonis Threat Labs identified AvisLoader, a 3.4 MB 64-bit Windows loader statically linking c-toxcore, which receives commands and follow-on payloads over the encrypted Tox peer-to-peer network instead of fixed C2 infrastructure. Infection starts with a fake DocuSign ClickFix page instructing victims to paste an attacker-supplied command that fetches code through a Cloudflare Quick Tunnel. Bundled components include auto.exe implementing UACME method 41 UAC bypass via ICMLuaUtil, shortcut hijacking of desktop and taskbar shortcuts, and hmn_hook.dll hooking NtQuerySystemInformation to hide processes. An operator command center tracks endpoint metadata and queues shell commands or payload transfers matching hardware, geography, or privilege criteria.
- AvisLoader uses Tox P2P so operators retain identity across infrastructure moves
- ClickFix DocuSign lure delivers payload via Cloudflare Quick Tunnel
- Includes UACME method 41 UAC bypass, shortcut hijacking, process-hiding DLL
- Command center queues tasks and delivers payloads over Tox by host criteria
- ATT&CK
- T1059.003 Windows Command ShellT1548.002 Bypass User Account ControlT1547.009 Shortcut ModificationT1564 Hide ArtifactsT1105 Ingress Tool Transfer
- Malware
- AvisLoader
- Organizations
- VaronisToxCloudflareDocuSign
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | trycloudflare.com | code through a Cloudflare Quick Tunnel address hosted under trycloudflare.com . While Cloudflare services are legitimate, their use in th |
| sha256 | 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc | onal malware blocking. IOCs Filename SHA-256 Role 78324.exe 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc AvisLoader Windows client auto.exe f0a6870cb774a55775eda15f |
| sha256 | cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5 | e8edff07ff3975 Bundled elevation-bypass helper hmn_hook.dll cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5 Bundled process-hiding library Note: IP addresses and domai |
| sha256 | f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975 | 280c9e6c525e09f3dd13c2cc AvisLoader Windows client auto.exe f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975 Bundled elevation-bypass helper hmn_hook.dll cd1e835f52e5f5 |
From the original article
4 min read at gbhackers.com
AvisLoader, a newly observed Windows malware loader designed to maintain operator access even when conventional command-and-control infrastructure is disrupted. Instead of relying on a fixed domain, IP address, or centralized server, the malware uses the encrypted Tox peer-to-peer messaging network to receive commands and deliver follow-on payloads. The discovery highlights a growing challenge for defenders: […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.