AvisLoader Malware Achieves Resilience Through Peer-to-Peer C2 and Fake Document Signing
AvisLoader, a new Windows malware loader, employs a sophisticated multi-stage attack chain and peer-to-peer communication to ensure persistence and evade traditional takedown methods.
A new Windows malware loader, dubbed AvisLoader, has emerged with a design focused on resilience against server takedowns, making it significantly harder for security professionals to disrupt its operations. The malware initiates its infection vector through a deceptive social engineering tactic: a fake document-signing page that mimics legitimate services like DocuSign. This page tricks unsuspecting users into manually executing a command, which, instead of verifying a document, downloads and executes malicious code via a Cloudflare tunnel.
Varonis Threat Labs discovered AvisLoader on an exposed staging server, revealing not only the malware's components but also an operator dashboard. This setup suggests a ready-to-deploy solution for attackers seeking persistent remote access. Unlike many malware families that rely on fixed command-and-control (C2) server addresses, AvisLoader utilizes the Tox network for encrypted peer-to-peer messaging. This decentralized communication model means there are no central servers for defenders to target or block, greatly enhancing the malware's survivability.
The seller of AvisLoader on a cybercrime forum claimed that the operator's control could be maintained even after server migration by simply copying the Tox save file, allowing clients to reconnect using the same operator identity. While researchers have not confirmed large-scale deployments or successful takedowns and recoveries, the design and seller claims point to a robust and persistent threat. The malware's ability to receive commands and additional files over the Tox network, coupled with the initial Cloudflare tunnel for code delivery, presents a layered approach to C2 communication.
Beyond its resilient C2 infrastructure, AvisLoader employs stealthy techniques to maintain persistence on infected systems. The recovered Windows sample, a 64-bit executable, includes code designed to modify desktop and taskbar shortcuts. When a user launches a legitimate application through one of these altered shortcuts, AvisLoader executes in the background, making its presence less conspicuous. This method of hijacking familiar application launchers is a known technique to evade user detection.
Further analysis of the malware sample revealed code that references a known Windows privilege-bypass method and a library capable of hiding processes from system listings. While the successful deployment of these capabilities on actual targets remains unconfirmed, their inclusion indicates the malware's potential to escalate privileges and operate with greater stealth. The recovered tools showcase the potential capabilities of AvisLoader, even if concrete evidence of widespread victim activity is still emerging.
Security teams are advised to be vigilant against document or verification pages that instruct users to paste commands into terminal or Run dialogs. Defenders should monitor for suspicious script activity, unexpected peer-to-peer network traffic, and investigate altered desktop and taskbar shortcuts. Correlating suspicious page prompts with command execution, local system changes, and network behavior is crucial, rather than relying solely on blocking specific domains, as services like Cloudflare have legitimate uses.
Indicators of compromise include the AvisLoader Windows client executable (SHA-256: 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13cc), bundled helper files, and specific DLL exports like HMN_HideStart. The use of Cloudflare tunnels and Tox network communication, along with the manipulation of shortcuts, are key indicators of potential AvisLoader activity.