Varonis Threat Labs uncovered AvisLoader, a Windows loader delivered through a ClickFix lure and designed to communicate over the Tox peer-to-peer network for command-and-control. The recovered tooling included shortcut-persistence artifacts, a UAC bypass helper, and a process-hiding DLL, with exposed management features in the AvisLoader Command Center. #AvisLoader #Tox #ClickFix #UACME #NtQuerySystemInformation
Keypoints
- AvisLoader is a newly discovered Windows loader found on an exposed staging server with a ClickFix lure and supporting tools.
- The initial infection flow uses a fake document-signing or verification page that tricks users into copying and running an attacker-supplied command.
- AvisLoader communicates through Tox, an encrypted peer-to-peer messaging network, reducing reliance on fixed domains or servers for C2.
- The recovered Windows sample includes shortcut-persistence artifacts and a launcher named VLCAssistant that suggest modified shortcuts may be used for execution.
- A bundled helper, auto.exe, references UACME method 41 and the ICMLuaUtil COM elevation mechanism, indicating attempted UAC bypass.
- A separate DLL, hmn_hook.dll, hooks NtQuerySystemInformation to hide a specified process name from process listings.
- The AvisLoader Command Center supports client management, shell tasks, and file delivery over Tox, showing operator control capabilities.
MITRE Techniques
- [T1204.004 ] User Execution: Malicious Copy and Paste – The ClickFix lure tricks the victim into pasting and running attacker-provided code (‘paste and run an attacker-supplied command’).
- [T1547.009 ] Boot or Logon Autostart Execution: Shortcut Modification – The loader’s artifacts indicate modified desktop and taskbar shortcuts used to launch malware when opened (‘support the modification of desktop and taskbar shortcuts’).
- [T1548.002 ] Abuse Elevation Control Mechanism: Bypass User Account Control – The bundled auto.exe helper references UACME method 41 and the ICMLuaUtil COM elevation path (‘implements the UACME method 41 bypass’).
- [T1014 ] Rootkit – The hmn_hook.dll library hooks NtQuerySystemInformation to hide a chosen process from returned results (‘hooks NtQuerySystemInformation to filter a specified process name’).
- [T1071 ] Application Layer Protocol – AvisLoader uses c-toxcore for Tox-based peer-to-peer command-and-control communications (‘communicate with its controller as another peer on the network’).
- [T1105 ] Ingress Tool Transfer – The Command Center can stage and deliver files to clients over Tox (‘provides an interface for staging files and describes delivery “to clients over Tox”’).
Indicators of Compromise
- [File names and SHA-256 hashes ] AvisLoader samples and bundled tools – 78324.exe, 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc; auto.exe, f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975; hmn_hook.dll, cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5
- [Persistence and launcher artifacts ] Shortcut-based launch behavior – VLCAssistant, .backup
- [Embedded path and COM reference ] Loader/developer and elevation-related strings – C:UsersdevDesktopc-toxcore, {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
- [Function and export names ] Process-hiding behavior indicators – NtQuerySystemInformation, HMN_HideStart, HMN_HideStatus, HMN_HideStop
- [Cloud service-related domains ] Delivery and lure infrastructure – workers.dev, trycloudflare.com
Read more: https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown