AvisLoader Uses Tox P2P Messaging to Resist Windows Malware Disruption
Summary
Researchers describe AvisLoader, a Windows malware loader delivered through a ClickFix lure. It uses encrypted Tox peer-to-peer messaging for commands and payloads, with recovered files showing shortcut-persistence and other endpoint capabilities.
Key points
- A DocuSign-themed ClickFix page urged users to paste a command that retrieved and ran code through a Cloudflare Quick Tunnel.
- The recovered payload was a 3.4 MB 64-bit Windows executable; researchers found no corresponding macOS payload despite the lure showing a macOS command.
- AvisLoader uses the Tox protocol for encrypted peer-to-peer command and payload delivery, avoiding dependence on a fixed C2 domain or server address.
- Artifacts indicate persistence through modified desktop and taskbar shortcuts, with a VBScript launcher associated with VLCAssistant.
- A helper references a public UAC bypass technique, but the recovered files do not establish that elevation succeeded.
- A separate DLL can filter a specified process from results returned by a Windows process-information function; researchers did not establish that it hid AvisLoader itself.
- The Command Center supports client management, shell tasks, and file staging; suggested monitoring includes suspicious pasted commands, shortcut changes, and unexpected Tox traffic.
Article Details
- Attack Vectors
- A ClickFix lure posing as a document-signing request asks visitors to paste and run an attacker-supplied command that retrieves and executes code from a Cloudflare Quick Tunnel address.
- AvisLoader communicates with its controller over Tox, an encrypted peer-to-peer messaging network, and its Command Center supports shell tasks and file delivery over Tox.
- The loader contains code designed to persist by modifying desktop and taskbar shortcuts, with a VBScript launcher associated with VLCAssistant.
- The recovered auto.exe helper references UACME method 41 and the ICMLuaUtil COM elevation mechanism; the article notes that this does not establish successful elevation.
- The hmn_hook.dll sample hooks NtQuerySystemInformation and filters a specified process name from results. The recovered files do not establish that it was loaded into Task Manager or used to hide AvisLoader.
- Defensive Notes
- Treat document-signing or verification pages that ask users to paste commands into a terminal or Windows Run dialog as suspicious, and encourage users to report them before running the command.
- Investigate unfamiliar workers.dev and trycloudflare.com addresses in document-signing lures or commands that download and execute code; both domains also support legitimate services, so assess the page content and surrounding activity.
- Monitor command shells and script interpreters that retrieve and execute remote code, especially after visits to suspicious pages, and check for unexpected Tox or other peer-to-peer traffic on the same device.
- Hunt for modified desktop and taskbar shortcuts, associated .backup files, and references to VLCAssistant. Investigate recovered auto.exe and hmn_hook.dll samples and examine surrounding activity for elevation attempts or process-list hooks.
MITRE ATT&CK
T1547.009 · Shortcut ModificationAvisLoader's persistence code is designed to modify desktop and taskbar-pinned shortcuts so the malware launches when a user opens one.T1548.002 · Bypass User Account ControlThe recovered auto.exe helper references UACME method 41 and the ICMLuaUtil COM elevation mechanism associated with a UAC bypass; the article does not establish successful elevation.
Malware
Products
Tools
c-toxcoreThe executable statically links c-toxcore, the reference implementation of the Tox protocol, and retains the developer’s build path, C:\Users\dev\Desktop\c-toxcore.UACMEThe recovered files also include auto.exe, a small helper that references method 41 from UACME, a public User Account Control (UAC) bypass project.