** Researchers at Varonis Threat Labs discovered it on a staging server alongside a ClickFix lure and a Command Center.

Overview of AvisLoader

  • Purpose: Load additional payloads while maintaining encrypted, domain-less communication.

Consequently, defenders must focus on behavior rather than network indicators.

Threat Context

Attackers lure victims into pasting a verification command, then AvisLoader establishes a persistent Tox session.

Delivery Through ClickFix and Cloudflare

  • Host: Cloudflare Workers serve a fake DocuSign page.
  • Command: The clipboard holds a script that downloads and executes code from a trycloudflare.com Quick Tunnel address.

Therefore, the download bypasses normal browser telemetry, reducing visibility for endpoint detection platforms.

Loader Architecture and Tox Integration

Component Description
Executable 64-bit PE, ~3.4 MB, asInvoker manifest, 17 non-executable sections named after packers (e.g., Themida, VMProtect).
c-toxcore Statically linked library that powers the encrypted P2P channel.
Build Path C:\Users\dev\Desktop\c-toxcore appears in the binary, indicating a development artifact.
C2 Channels Outbound connections to ports 33445/33446 (default Tox ports).

Additionally, the loader encrypts all peer-to-peer sessions, making deep packet inspection ineffective.

Persistence, Escalation, and Stealth Techniques

  • Stealth: Uses multiple packer signatures to evade static analysis; hides network traffic within legitimate Tox traffic.

Consequently, analysts should monitor for unsigned binaries that reference c-toxcore or contain the development path.

Detection Opportunities and Defensive Measures

Therefore, a layered approach—combining endpoint detection, network filtering, and user awareness—offers the best chance to stop AvisLoader infections.

Summary of Findings

  • The ClickFix lure exploits user trust in Cloudflare-hosted verification dialogs.
  • Detection relies on behavioral indicators rather than static indicators of compromise.

Interestingly, while the lure displays a macOS command, the exposed directory contained a Windows loader. We found no corresponding macOS payload among the recovered files.

ClickFix lure mechanics

The lure relies entirely on user interaction. The victim copies the command and executes it, effectively walking the malware past browser safeguards.

Use of Cloudflare Quick Tunnel (trycloudflare.com)

The command contacts a Cloudflare Quick Tunnel address. This allows the attacker to serve payloads from a dynamic endpoint, hiding the static IP or domain.

Once the payload lands, the loader must establish a stealthy, permanent line of communication.

Loader architecture and Tox integration

The Windows payload is a single 3.4 MB 64-bit executable.

Its manifest specifies asInvoker. This means it inherits the privileges of the launching process without triggering a User Account Control (UAC) prompt at startup.

The section table contains seventeen additional sections of identical size. These carry names associated with well-known packers: Themida, VMProtect, Enigma, and UPX. None are marked executable.

These labels are a smokescreen. They aim to confuse automated packer identification tools, though the names alone don't prove those specific packers were used.

At its core, the executable is a Tox client.

It statically links c-toxcore, the reference implementation of the Tox protocol. The binary even retains the developer’s build path: C:\Users\dev\Desktop\c-toxcore.

By using Tox, the loader communicates with its controller as another peer on the network.

Executable structure and packer-named sections

Analysts will find seventeen non-executable sections mimicking popular packers. It is a simple but effective trick to hinder automated detection.

Embedded Tox client functionality

This allows the loader to operate without relying on external libraries.

Connectivity is only half the battle; the malware must survive a reboot and escalate its reach.

Persistence, escalation, and stealth techniques

AvisLoader targets shortcuts on the desktop and in the taskbar-pinned folder for persistence.

The executable contains shortcut-backup strings and a VBScript launcher named VLCAssistant. These artifacts reveal a mechanism that launches the malware when a user opens a modified shortcut, then immediately starts the intended application to maintain the illusion of normalcy.

Its strings identify the ICMLuaUtil interface and the Component Object Model (COM) elevation mechanism.

The helper warns that updated Windows versions may mitigate the bypass. Its presence indicates intent, not necessarily successful elevation.

A separate dynamic-link library (DLL), hmn_hook.dll, handles process hiding. It hooks NtQuerySystemInformation—the function Windows uses to retrieve process lists—and filters out a specified process name.

While this could hide the malware from system tools, the recovered files do not prove the DLL was successfully loaded into Task Manager.

Shortcut-based persistence and VLCAssistant launcher

Modified shortcuts act as the trigger. VLCAssistant ensures the legitimate app still opens, masking the malicious execution.

Auto.exe and UAC bypass via ICMLuaUtil

hmn_hook.dll process-hiding implementation

The hook DLL filters its own process name from enumeration results.

The loader is the foot soldier; the Command Center is the general.

AvisLoader Command Center and operator capabilities

The recovered tools provide a window into the operator's capabilities.

The web panel, branded the AvisLoader Command Center, allows operators to manage clients, configure tasks, and distribute files. The dashboard tracks total, online, and offline clients via a world map.

A Clients table aggregates host information: hostname, country, CPU, GPU, antivirus status, administrator privileges, and a public key. This public key aligns with the Tox peer identity model.

The Tasks tab allows operators to configure shell commands. Some tasks run automatically when a matching client comes online, allowing operators to queue commands in advance.

Client inventory and public-key fields

The Command Center aggregates detailed host attributes. This enables surgical operations based on geography or privilege.

Task configuration and targeting options

Operators pre-define shell commands that execute the moment a matching client checks in.

File staging and delivery over Tox

Payloads upload to the panel and push through the encrypted Tox channel. No traditional file server is exposed.

Knowing how the operator manages the botnet allows defenders to build better traps.

Detection opportunities and defensive measures

AvisLoader leaves several footprints, from the initial ClickFix command to shortcut modifications and anomalous Tox traffic.

Security teams should monitor four key areas:

**1.

**2.

**3. Note that a user-pasted command may run without the browser appearing as its parent process.

4. Host Artifacts. Hunt for modified desktop and taskbar shortcuts, .backup files, and references to VLCAssistant. Search for auto.exe and hmn_hook.dll samples to identify elevation attempts or process-list hooks.

Suspicious document-signing prompts and command paste attempts

Educating users to never copy-and-paste terminal commands is the most effective primary mitigation.

Monitoring of workers.dev and trycloudflare.com domains

Network sensors should flag outbound connections to these domains if they fall outside known business workflows.

Observation of remote-code-execution shells and P2P traffic

SIEM rules that correlate shell execution with subsequent Tox traffic can surface the attack in its early stages.

File-integrity monitoring on shortcut directories can reveal the presence of .backup files or VLCAssistant launchers.

Summary of findings and implications

AvisLoader wraps familiar malware techniques around the Tox protocol.

Detection requires looking beyond the network connection to the application behavior on the device.