Overview of AvisLoader Discovery
Varonis Threat Labs discovered AvisLoader, a new Windows malware loader named after the Latin word for bird, on an exposed staging server alongside a ClickFix lure and supporting tools. The loader is designed to resist disruption through its use of encrypted peer-to-peer communication.
Infection Vector: ClickFix Lure via Cloudflare Services
The attack begins with a ClickFix lure hosted on Cloudflare Workers, designed to mimic a DocuSign document-signing request. A fake "Manual verification" dialog claims verification is handled by Cloudflare and instructs users to paste a "verification code" into a terminal. This command retrieves and executes code from a Cloudflare Quick Tunnel address on trycloudflare.com, bypassing normal browser download flows.
Although the lure displayed a macOS command, the recovered files contained only a Windows loader, with no corresponding macOS payload found.
Technical Analysis of the Windows Payload
The Windows payload is a single 3.4 MB 64-bit executable. Its manifest specifies asInvoker, meaning it runs with the privileges of the launching process without triggering User Account Control (UAC) elevation at startup. The executable’s section table contains seventeen additional sections of identical size, named after well-known packers such as Themida, VMProtect, Enigma, and UPX. None of these sections are marked executable, suggesting the names are intended to confuse packer identification rather than indicate actual use of those tools.
Underneath, the loader functions as a Tox client, statically linking c-toxcore, the reference implementation of the Tox protocol. The binary retains the developer’s build path: C:\Users\dev\Desktop\c-toxcore. This allows the loader to communicate with its operator as another peer on the Tox network, eliminating reliance on a centralized C2 server.
Persistence, Privilege Escalation, and Stealth Mechanisms
AvisLoader establishes persistence by targeting desktop and taskbar-pinned shortcuts. It includes shortcut-backup strings and a VBScript launcher associated with the name VLCAssistant. This mechanism launches the malware when a user opens a modified shortcut, then starts the intended application to maintain normal appearance.
The recovered file auto.exe references method 41 from the UACME project, using the ICMLuaUtil interface and COM elevation technique to bypass UAC. The file notes that updated Windows versions may mitigate this bypass, so its presence does not confirm successful elevation.
A separate DLL, hmn_hook.dll, provides process-hiding functionality by hooking NtQuerySystemInformation to filter a specified process name from results. While this could hide processes from tools using the hooked function, the recovered files do not confirm the DLL was loaded into Task Manager or used to hide AvisLoader itself.
AvisLoader Command Center Capabilities
The AvisLoader Command Center is a web panel used by operators to manage infected clients. It displays counts of total, online, and offline clients, along with a world map. The Clients table includes hostname, country, CPU, GPU, antivirus status, administrator status, and a public key field consistent with Tox’s peer identity model.
The Tasks tab allows operators to configure shell commands and target clients by hardware, location, and administrator status, supporting execution when matching clients come online. The Files tab enables staging and delivery of additional payloads to clients over the Tox network.
Detection Guidance for Security Teams
Security teams can detect AvisLoader through several indicators:
- Treat any document-signing or verification page that asks users to paste and run commands in a terminal or Windows Run dialog as suspicious.
- Investigate unfamiliar
workers.devandtrycloudflare.comaddresses appearing in such lures or commands, as they may indicate malicious use of legitimate services. - Monitor command shells and script interpreters that retrieve and execute remote code, especially following visits to suspicious pages.
- Check for unexpected Tox or other peer-to-peer traffic on endpoints, noting that user-pasted commands may run without the browser as a parent process.
- Hunt for modified desktop and taskbar shortcuts, associated
.backupfiles, and references toVLCAssistant. - Investigate matches for
auto.exeandhmn_hook.dll, then examine surrounding activity for UAC bypass attempts or process-list hooking behavior.
Conclusion: Tox as a Resilient C2 Channel
AvisLoader combines familiar malware techniques with the Tox peer-to-peer network to create a resilient loader. Its use of Tox allows operators to maintain control by simply copying the Tox save file to a new server, with clients reconnecting without needing domain reconfiguration.
For defenders, this highlights that legitimate peer-to-peer protocols like Tox can be abused for C2. Effective detection requires examining not just network traffic, but also the application generating it and its behavior on the host.
Source: BleepingComputer