AvisLoader Windows Malware That Learned to Survive Even After Its Servers Are Taken Down

AvisLoader is a Windows malware loader built to keep taking instructions after server takedowns. That makes it difficult to disrupt by simply removing a malicious website.

It starts with a fake document-signing page that asks visitors to run a command themselves, turning a familiar verification request into a possible infection on the device.

The signing page demands a manual check, claiming a security provider handles it. Instead of verifying anything, the pasted command retrieves and runs code through a temporary tunnel instead of a normal browser download.

It mirrors fake verification page tactics seen in other ClickFix campaigns and makes the user launch the attack. Varonis Threat Labs identified AvisLoader on an exposed staging server with a lure, supporting files and an operator dashboard.

Varonis said in a report shared with Cyber Security News (CSN) that the loader uses encrypted peer-to-peer messaging rather than a fixed domain to receive commands and additional files.

The discovery shows a route for lasting remote access, not a measured outbreak. Researchers did not report victim numbers. The tools show how a misleading page could create a controllable Windows client that can receive later instructions and files.

AvisLoader Windows Malware

Takedowns often disable the domain or server address malware calls for instructions, interrupting the operator’s contact with infected machines.

AvisLoader instead uses Tox, a messaging network where computers communicate as peers. Its Windows executable includes the Tox software directly, avoiding reliance on a fixed control address that defenders could easily seize or block.

A seller advertising AvisLoader on a cybercrime forum claimed the controller could be moved by copying its Tox save file. Clients could then follow the same operator identity after a move.

Researchers did not observe a successful takedown and recovery, so the resilience described here is a design feature and seller claim.

The design does not make AvisLoader invisible. Security teams can still see unusual network connections and investigate what happens on the device.

A Cloudflare tunnel supplies code; Tox carries later instructions. Reporting on Cloudflare tunnels used for malware shows why download routes and control channels should be distinguished. The dashboard lists clients, device details, security software and administrator status.

Its task controls can prepare shell commands for selected computers when they connect, while a file area offers delivery of further payloads over Tox. Researchers did not confirm any transfers or how many computers might have connected to the panel.

Shortcuts, Stealth and Detection

The recovered Windows program is a 3.4 MB, 64-bit executable that starts with the privileges of the user who launches it.

Its extra sections carry names associated with commercial software packers, but do not prove a packer was used. The lure displayed a macOS command, yet researchers found no corresponding Mac payload.

Inside the Windows sample, researchers found code aimed at changing desktop and pinned taskbar shortcuts. Opening an altered shortcut could launch the malware and then the expected application, reducing the chance that a user notices.

Other Windows shortcut malware campaigns illustrate why shortcut changes deserve attention, although the infection chains differ.

A bundled helper references a known Windows privilege-bypass method, while another library can hide a chosen process from listings.

Neither finding proves the bypass succeeded or that the hiding code was deployed on a real target. Recovered tools show possible capabilities, not confirmed victim activity.

To reduce exposure, users should report document or verification pages that instruct them to paste commands into a terminal or Run dialog.

Defenders should review suspicious script activity afterward and unexpected peer-to-peer traffic. A pasted command may run without appearing as a child of the browser process, complicating a search focused only on browser activity.

Teams should also inspect altered desktop and taskbar shortcuts and investigate related backup artifacts and recovered helper files.

Investigate unfamiliar cloud-hosted addresses in context, since the services have legitimate uses and should not be blocked wholesale. Correlate the page, command, local changes and network behavior instead of relying on one domain.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File and SHA-256	78324.exe / 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc	AvisLoader Windows client
File and SHA-256	auto.exe / f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975	Bundled elevation-bypass helper
File and SHA-256	hmn_hook.dll / cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5	Bundled process-hiding library
Domain	workers.dev	Shared hosting domain to investigate when associated with a suspicious signing lure; not inherently malicious
Domain	trycloudflare.com	Shared tunnel domain to investigate when associated with a suspicious download command; not inherently malicious
Launcher name	VLCAssistant	Persistence-related launcher name
File extension	.backup	Shortcut backup extension relevant alongside modified shortcuts
Build path	C:\Users\dev\Desktop\c-toxcore	Developer path embedded in the loader
DLL exports	HMN_HideStart, HMN_HideStatus, HMN_HideStop	Exports of the recovered process-hiding library
Hooked function	NtQuerySystemInformation	Legitimate Windows function targeted by the process-hiding library
COM class identifier	{3E5FC7F9-9A51-4367-9063-A120244FBEC7}	Identifier referenced by the elevation-bypass helper

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC