Full Report
A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. [...]
Analysis Summary
# Tool/Technique: AvisLoader
## Overview
AvisLoader is a sophisticated Windows-based malware loader designed for resilience and stealth. Its primary purpose is to deliver additional payloads and execute remote commands while bypassing traditional network defenses. It is notable for its use of the Tox peer-to-peer (P2P) protocol for command-and-control (C2) communication, which eliminates the need for fixed domains or centralized servers, making infrastructure takedowns significantly more difficult.
## Technical Details
- **Type:** Malware loader
- **Platform:** Windows (64-bit)
- **Capabilities:** P2P communication, remote command execution, UAC bypass, process hiding, and persistence via shortcut hijacking.
- **First Seen:** October 2026 (Reported date)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link (ClickFix lure)]
- **[TA0002 - Execution]**
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- [T1204.002 - User Execution: Malicious File]
- **[TA0003 - Persistence]**
- [T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification]
- **[TA0004 - Privilege Escalation]**
- [T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control (UACME/ICMLuaUtil)]
- **[TA0005 - Defense Evasion]**
- [T1564.001 - Hide Artifacts: Hidden Files and Directories]
- [T1056.001 - Input Capture: Keylogging (hooking NtQuerySystemInformation)]
- [T1140 - Deobfuscate/Decode Files or Information]
- **[TA0011 - Command and Control]**
- [T1102.003 - Web Service: One-Way Communication (Tox P2P)]
## Functionality
### Core Capabilities
- **P2P C2 Communication:** Utilizes the Tox protocol (`c-toxcore` library) to receive commands and payloads. This allows the operator to maintain connection with infected clients even if the management server's IP or location changes.
- **Payload Delivery:** Functions as a primary stage loader to retrieve and execute secondary malware.
- **Remote Command Execution:** Capable of running arbitrary commands sent via the Tox network.
### Advanced Features
- **Anti-Analysis/Evasion:** Features seventeen decoy sections in its PE header named after common packers (Themida, VMProtect, etc.) to mislead automated scanners and analysts.
- **Stealth via Hooking:** Employs `hmn_hook.dll` to hook `NtQuerySystemInformation`, allowing it to hide specific processes from Task Manager or other system monitoring tools.
- **UAC Bypass:** Includes a helper tool (`auto.exe`) that leverages the `ICMLuaUtil` COM interface (UACME Method 41) to attempt privilege escalation.
- **Shortcut Hijacking:** Implements persistence by modifying desktop and taskbar shortcuts, using a VBScript launcher (`VLCAssistant`) to ensure the malware runs when the user launches legitimate applications.
## Indicators of Compromise
- **File Names:**
- `78324.exe` (Primary Loader)
- `auto.exe` (UAC bypass helper)
- `hmn_hook.dll` (Process hiding library)
- `VLCAssistant` (VBScript/Persistence artifact)
- **Network Indicators:**
- `trycloudflare[.]com` (Used for initial payload delivery via Cloudflare Quick Tunnels)
- Tox Protocol Traffic (Non-standard P2P encrypted traffic)
- **Behavioral Indicators:**
- Modification of `.lnk` files on the Desktop and Taskbar.
- Unexpected calls to `ICMLuaUtil` COM interface.
- Process name: `78324.exe` (or variations found in staging).
## Associated Threat Actors
- Unknown (Advertised on cybercrime forums as a commercial product).
## Detection Methods
- **Behavioral Detection:** Monitor for unauthorized modifications to shortcut (`.lnk`) files and the execution of PowerShell/CMD commands originating from clipboard actions (ClickFix patterns).
- **Network Detection:** Identify and alert on Tox protocol traffic, which is uncommon in enterprise environments.
- **Host-Based Detection:** Scan for the presence of `c-toxcore` strings or specific build paths (e.g., `C:\Users\dev\Desktop\c-toxcore`) within executables.
## Mitigation Strategies
- **User Training:** Educate users on "ClickFix" tactics, specifically warning against copying and pasting commands into the terminal/Run dialog from websites.
- **Attack Surface Reduction:** Implement policies to block or restrict the execution of scripts (VBScript, PowerShell) from user-writable directories.
- **Network Filtering:** Block known P2P protocols like Tox if they are not required for business operations.
- **Privilege Management:** Enforce standard user privileges to mitigate the impact of UAC bypass techniques.
## Related Tools/Techniques
- **ClickFix:** The social engineering delivery mechanism.
- **UACME:** The source of the UAC bypass technique used by `auto.exe`.
- **Cloudflare Workers/Tunnels:** Used for hosting lures and initial staging infrastructure.