The Windows payload is a single 3.4 MB 64‑bit executable.
Varonis Threat Labs discovered that file and a broader toolset linked to a new loader they named AvisLoader — a package built to remain connected to operators by using the Tox encrypted peer‑to‑peer (P2P) messaging protocol rather than a conventional domain‑based command‑and‑control server.
ClickFix lure and Cloudflare delivery
Varonis recovered the initial lure as a ClickFix page made to look like a DocuSign signing request and hosted on Cloudflare Workers. The fake “Manual verification” dialog instructs visitors to paste a verification command into a terminal; what lands on the clipboard is a command that retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com. Although the lure presents a macOS command, the exposed directory held a Windows loader, and Varonis did not find a corresponding macOS payload among the recovered files.
Because the pasted command executes outside the browser’s normal download flow, a user can run a download and execution step without the browser appearing as the parent process. Varonis highlights workers.dev and trycloudflare.com as domains to investigate when they appear in document‑signing lures or in commands that fetch and run remote code, while noting both domains also support legitimate services.
Tox peer‑to‑peer protocol for resilient C2
The standout design choice in AvisLoader is network communications: the executable is a Tox client. The sample statically links c‑toxcore, the reference implementation of the Tox protocol, and retains the developer build path C:\Users\dev\Desktop\c‑toxcore. Tox lets the loader communicate with its controller as another peer on the encrypted P2P network, meaning the command‑and‑control channel does not depend on a fixed domain or server address.
Varonis points out operational implications: a seller in a cybercrime forum claimed the controller can be moved by copying its Tox save file, with clients following without the need for a domain. That model reduces the usefulness of traditional domain‑based takedowns because operators can preserve identity while relocating to another server or host.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePersistence, escalation, and stealth mechanisms
On the host, AvisLoader includes multiple techniques intended to persist and to make discovery harder. The recovered sample’s persistence code targets shortcuts on the desktop and in the taskbar‑pinned folder, with shortcut‑backup strings and a VBScript launcher associated with the name VLCAssistant; those artifacts indicate a mechanism that launches the malware when a user opens a modified shortcut and then starts the intended application so it appears to open normally.
Supporting components include auto.exe, a small helper that references method 41 from UACME, a public UAC bypass project. The helper’s strings identify the ICMLuaUtil interface and the COM elevation mechanism associated with that technique, and the file contains a warning that updated Windows versions may mitigate the bypass — language Varonis says means the helper’s presence does not on its own establish successful elevation.
Another recovered file, hmn_hook.dll, provides process‑hiding functionality by hooking NtQuerySystemInformation and filtering a specified process name from results. Varonis notes this could hide a process from software that uses the hooked function, but the recovered artifacts do not establish the DLL was loaded into Task Manager or used to hide AvisLoader itself.
The AvisLoader Command Center
Files recovered alongside the loader reveal an operator web panel branded the AvisLoader Command Center. The dashboard presents counts of total, online, and offline clients and a world map. A Clients table brings together host details — hostname, country, CPU, GPU, antivirus, administrator status — and a public key field consistent with Tox’s peer identity model.
The Tasks tab lets operators configure shell commands, select clients by hardware, location, and administrator status, and prepare tasks to run when matching clients come online. The Files tab provides an interface for staging files and explicitly describes delivery “to clients over Tox,” indicating the panel is designed to stage additional payloads for distribution across the P2P network.
What this means for technologists, enterprises, and end users
- Technologists and security teams: Monitor for pasted commands that fetch and execute code, investigate unexpected Tox or other P2P traffic, and hunt for shortcut changes, .backup files, and references to VLCAssistant, auto.exe, and hmn_hook.dll.
- Affected enterprises and procurement leaders: Treat workers.dev and trycloudflare.com appearances in signing lures as signals requiring contextual review; consider controls that block or flag terminal commands copied from untrusted pages before execution.
- End users: Report document‑signing or verification pages that ask you to paste commands into a terminal or the Windows Run dialog and do not run those commands without verification from the sender or security staff.
AvisLoader combines familiar host techniques — shortcut persistence, a VBScript launcher, an optional UAC bypass helper, and a process‑filtering DLL — with a less common transport: an encrypted P2P messaging protocol that can carry operator commands and additional malware. Detecting it therefore requires looking at both the application behavior on the endpoint and the distinctive network connections that application makes.
Read the original Varonis‑sourced writeup at BleepingComputer: https://www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/
