AvisLoader Windows Malware That Learned to Survive Even After Its Servers Are Taken Down
AvisLoader, a Windows malware loader, spreads through fake verification pages and uses encrypted peer-to-peer messaging to deliver instructions and files.
AvisLoader Windows malware spreads through fake verification pages, using encrypted peer-to-peer messaging to deliver instructions and files after server takedowns.
- Corp MDM malware targets logistics firms and steals SMS and redirects calls
- Attacker uses AI during development and uses credential phishing and Windows malware
- Products
- OpenAI agents
- Threat actors
- OpenAI
- Malware
- Corp MDM
- Organizations
- Australian Prime MinisterOpenAI
- Countries
- Australia
- AI models
- OpenAI agents
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc | ):- Type Indicator Description File and SHA-256 78324.exe / 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc AvisLoader Windows client File and SHA-256 auto.exe / f0a68 |
| sha256 | cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5 | led elevation-bypass helper File and SHA-256 hmn_hook.dll / cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5 Bundled process-hiding library Domain workers.dev Shared ho |
| sha256 | f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975 | 3c2cc AvisLoader Windows client File and SHA-256 auto.exe / f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975 Bundled elevation-bypass helper File and SHA-256 hmn_hook.d |
From the original article
4 min read at cybersecuritynews.com
AvisLoader is a Windows malware loader built to keep taking instructions after server takedowns. That makes it difficult to disrupt by simply removing a malicious website. It starts with a fake document-signing page that asks visitors to run a command themselves, turning a familiar verification request into a possible infection on the device.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.