Clarissa Hana
Varonis Threat Labs has identified a novel Windows malware loader, dubbed AvisLoader, a name derived from the Latin word for "bird." The discovery was made on an exposed staging server, revealing a sophisticated operation that included a deceptive ClickFix lure, supporting tools, and a dedicated Command Center. This new threat represents a significant advancement in how attackers manage and deploy malicious payloads, primarily due to its innovative use of the Tox encrypted peer-to-peer (P2P) messaging network for its command and control (C2) infrastructure.
The initial entry vector for AvisLoader relies on a well-established social engineering tactic: the ClickFix lure. This method presents users with a seemingly legitimate request, often disguised as a document-signing service like DocuSign, prompting them to execute a command on their local machine to proceed. This approach cleverly bypasses traditional browser-based download mechanisms, embedding the malicious download within a user-initiated command execution.
AvisLoader’s true innovation lies in its communication protocol. Instead of relying on vulnerable, easily traceable domain names or IP addresses for its C2 server, the malware communicates via Tox. Tox is a decentralized, end-to-end encrypted P2P messaging network, which makes traditional domain-based takedown strategies significantly more challenging. Attackers can maintain their operational identity and C2 infrastructure even when migrating to different servers, as the Tox network does not depend on a fixed server address. Evidence of this flexibility was found in a cybercrime forum listing, where sellers explicitly advertised the ease of moving the AvisLoader controller by simply copying its Tox save file, with clients automatically following.
This report delves into the operational mechanics of AvisLoader, mapping its activities to the MITRE ATT&CK framework and providing actionable indicators for security teams to detect and mitigate its presence.
Delivery Through Deception: ClickFix and Cloudflare Workers
The specific ClickFix lure discovered in conjunction with AvisLoader was hosted on Cloudflare Workers, a serverless computing platform. This lure was meticulously crafted to mimic a DocuSign signing request, aiming to engender trust and prompt immediate user action. A fabricated "Manual verification" dialog box falsely claimed that "Verification is handled by Cloudflare," further obfuscating the malicious intent. It then instructed visitors to paste a "verification code" into a terminal window, framing it as a necessary step to access the purported document.
The "verification code" provided was, in reality, a command designed to retrieve and execute code from a Cloudflare Quick Tunnel address on trycloudflare.com. While a download still occurred, it was executed via the pasted command in the terminal, effectively circumventing the browser’s standard download protocols and potentially evading certain browser-based security measures. Although the lure presented a macOS command, the exposed staging server contained a Windows loader, with no corresponding macOS payload identified among the recovered files. This suggests a primary focus on Windows environments or a potential for broader platform targeting in future iterations.
Inside the Loader: Obfuscation and Tox Integration
The primary Windows payload of AvisLoader is a single, 3.4 MB 64-bit executable file. Its manifest is configured with asInvoker, a setting that allows the malware to inherit the privileges of the process that launches it, thereby circumventing the need for immediate User Account Control (UAC) elevation upon startup. This stealthy approach allows it to blend in more effectively with legitimate system processes.
A closer examination of the executable’s section table revealed seventeen additional sections of identical size. These sections were named after well-known packers such as Themida, VMProtect, Enigma, and UPX. While these names suggest the use of sophisticated packing techniques to obfuscate the malware’s true nature and hinder static analysis, their presence alone does not confirm the actual use of these specific packers. This naming convention appears to be a deliberate attempt to mislead security researchers and automated analysis tools, increasing the difficulty of initial identification.
Beneath this layer of obfuscation, AvisLoader functions as an integrated Tox client. The executable statically links c-toxcore, the reference implementation of the Tox protocol. Evidence of this integration is further supported by the retention of the developer’s build path: C:UsersdevDesktopc-toxcore. By embedding a Tox client, AvisLoader can establish direct, peer-to-peer communication with its controller. This decentralized C2 architecture significantly enhances its resilience, eliminating the single point of failure inherent in traditional client-server models. However, despite the encryption, the network connections established by the loader remain observable, and its activity on the host system can still be monitored.
Escalation, Persistence, and Stealth Mechanisms
AvisLoader employs several techniques to maintain its presence on an infected system and evade detection. Its persistence mechanisms primarily target shortcuts located on the user’s desktop and within the taskbar-pinned folder. The executable contains strings indicative of shortcut manipulation and a VBScript launcher named VLCAssistant. This suggests a strategy where the malware modifies legitimate shortcuts. When a user clicks on such a shortcut, the AvisLoader malware is executed first, followed by the intended application, creating the illusion that the application launched normally while the malware runs in the background.
Furthermore, recovered files include a small helper executable named auto.exe. This utility references method 41 from UACME, a publicly available project focused on User Account Control (UAC) bypass techniques. Its embedded strings identify the ICMLuaUtil interface and the Component Object Model (COM) elevation mechanism, both crucial components of this UAC bypass. While the presence of auto.exe indicates an attempt to escalate privileges, the developers themselves note that updated Windows versions may mitigate these bypasses, meaning its successful execution is not guaranteed.
For process-hiding capabilities, AvisLoader utilizes a dynamic-link library (DLL) named hmn_hook.dll. This DLL hooks the NtQuerySystemInformation Windows function, a core component used by the operating system to retrieve process information. By filtering out a specified process name from the results returned by this function, hmn_hook.dll can effectively hide malicious processes from security software that relies on NtQuerySystemInformation for process enumeration. However, the recovered files do not definitively confirm that this DLL was successfully loaded into critical system processes like Task Manager or used to conceal AvisLoader itself.
The AvisLoader Command Center: Operator Control and Management
The collection of recovered tools provides a comprehensive overview of AvisLoader’s operational capabilities, particularly through its web-based "AvisLoader Command Center." This dashboard serves as the central hub for threat actors to manage infected clients, configure malicious tasks, and distribute additional payloads.
The Command Center’s main dashboard presents key metrics, including the total number of active clients, the count of currently online and offline clients, and a geographical representation of infected systems on a world map. This visual data allows operators to quickly assess the scale and reach of their operation.
A detailed "Clients" table offers granular host information. Each entry includes fields such as hostname, country of origin, CPU and GPU specifications, detected antivirus software, administrator status, and crucially, a public key. This public key is intrinsically linked to Tox’s peer identity model, confirming the P2P communication channel. This rich dataset enables operators to profile their targets and tailor subsequent attacks based on specific system configurations and security postures.
The "Tasks" tab provides operators with the ability to define and schedule shell commands. A sophisticated filtering system allows clients to be selected for task execution based on hardware attributes, geographical location, and administrator privileges. The functionality to schedule tasks for execution upon client connection implies a proactive approach, allowing operators to prepare commands in advance and deploy them as soon as compromised systems become available.
Finally, the "Files" tab offers an interface for uploading and staging additional malicious files, referred to as payloads. The explicit mention of delivery "to clients over Tox" underscores the integrated nature of the platform, enabling seamless distribution of further malware or tools directly through the encrypted P2P network. This capability significantly enhances AvisLoader’s utility as a versatile loader for more complex and damaging cyberattacks.
Defenses and Takeaways: A Multi-Layered Approach
The sophisticated nature of AvisLoader presents security teams with multiple opportunities for detection and mitigation. From the initial ClickFix command execution and the subsequent unexpected Tox traffic, to the modifications made to system shortcuts, a multi-layered defense strategy is essential. The delivery mechanism, combined with the observed persistence and communication techniques, highlights four critical areas for security monitoring:
- Network Traffic Analysis: Monitoring for unusual Tox traffic, especially connections to unknown peers or traffic originating from unexpected processes.
- Endpoint Detection and Response (EDR): Implementing robust EDR solutions capable of detecting suspicious command execution, shortcut modifications, and the loading of unknown DLLs.
- Process Monitoring: Vigilantly tracking processes that attempt to bypass UAC or exhibit stealth behaviors by hooking system APIs.
- File Integrity Monitoring: Regularly checking for unauthorized changes to system shortcuts and the presence of suspicious executables or DLLs in common malware drop zones.
The Broader Implications of AvisLoader
AvisLoader represents a significant evolution in the landscape of Windows malware loaders. By integrating familiar attack techniques with the robust, encrypted communication capabilities of the Tox network, it poses a formidable challenge to traditional cybersecurity defenses. The ability to maintain a stealthy, decentralized C2 infrastructure, coupled with sophisticated persistence and privilege escalation mechanisms, makes AvisLoader a potent tool for sophisticated threat actors.
The implications for security teams are clear: the lines between legitimate communication protocols and malicious command channels are becoming increasingly blurred. Understanding the application layer of network traffic, beyond just the IP addresses and ports, is paramount. This means delving into the behavior of processes, scrutinizing their interactions with the operating system, and correlating these activities with observed network connections. As threat actors continue to innovate, security professionals must adapt their detection and response strategies to anticipate and counter these evolving tactics. The emergence of AvisLoader serves as a stark reminder that even encrypted, decentralized platforms can be co-opted for malicious purposes, demanding a more comprehensive and adaptive approach to cybersecurity.
