Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption

Varonis Uncovers a Loader Designed to Outlast Its Own Takedown

Researchers at Varonis Threat Labs have published a detailed technical breakdown of AvisLoader, a previously undocumented Windows malware loader found sitting on an exposed attacker staging server alongside its ClickFix lure, supporting tools, and web-based Command Center. Varonis named the loader after the Latin word for "bird."

What sets AvisLoader apart from the steady stream of commodity loaders is its command-and-control design: rather than relying on a hardcoded domain or IP address that defenders can sinkhole or seize, AvisLoader statically links c-toxcore — the reference implementation of the Tox peer-to-peer messaging protocol — and uses it as an encrypted, decentralized C2 channel. Combined with a ClickFix-style social-engineering lure, shortcut-hijacking persistence, and a UAC bypass attempt, the result is a loader explicitly engineered to survive infrastructure takedowns that would normally kill a campaign overnight.

Varonis found no evidence of active exploitation in the wild at the time of disclosure, but published the research publicly given the resilience the architecture provides once operators do deploy it.

Incident Details

How AvisLoader Works

Phase 1 — The ClickFix Lure

AvisLoader's infection chain begins with a now-familiar social-engineering technique known as ClickFix. Victims land on a web page — hosted on Cloudflare Workers — that impersonates a DocuSign signature-verification request. The page displays a message claiming that "Verification is handled by Cloudflare" and instructs the visitor to copy a "verification code" and paste it into a terminal or the Windows Run dialog in order to access the document.

The pasted command is not a verification code at all. It invokes certutil.exe, a built-in and typically trusted Windows certificate utility, to fetch and execute the AvisLoader payload from an attacker-controlled Cloudflare Quick Tunnel address (trycloudflare.com). Because the download leverages a legitimate, signed system binary over an ephemeral Cloudflare-hosted tunnel, the technique sidesteps many browser download protections and gives defenders a short-lived, hard-to-block domain to chase.

ClickFix's effectiveness rests on procedural trust: users who are accustomed to copy-pasting troubleshooting commands rarely stop to question a "verification" step that asks for the same action.

Phase 2 — Encrypted, Decentralized C2 via Tox

Once executed, AvisLoader's defining feature comes into play. The malware statically links c-toxcore, the open-source reference implementation of the Tox protocol — a peer-to-peer, end-to-end encrypted messaging system originally built for private communications, not malware. By riding on Tox instead of a traditional client-server C2 model, AvisLoader removes the single point of failure that law enforcement and infrastructure takedowns typically target: there is no fixed domain or IP to seize.

Varonis notes that operators can relocate their entire command infrastructure simply by copying their Tox save file to a new machine — infected clients continue to reach the operator automatically through the Tox network's distributed hash table, with no need to push a domain or IP update to victims. This dramatically raises the cost of disruption compared to sinkholing a C2 domain or taking down a hosting provider.

The compiled binary retains debug artifacts, including the build path C:\Users\dev\Desktop\c-toxcore, confirming the Tox library's direct inclusion rather than a loosely coupled dependency.

Phase 3 — Obfuscation and Anti-Analysis

The AvisLoader executable's section table contains seventeen additional sections of identical size, bearing names associated with well-known commercial packers — Themida, VMProtect, Enigma, and UPX. Varonis cautions that these names alone do not confirm any of those packers was actually used; they appear designed to confuse automated packer-identification tools and slow down analyst triage rather than reflect genuine protection layers.

The sample's manifest specifies asInvoker, meaning the executable does not request UAC elevation at launch and simply inherits whatever privilege level the parent process already holds.

Phase 4 — Shortcut-Hijack Persistence

For persistence, AvisLoader targets shortcuts on the desktop and in the taskbar-pinned folder rather than the more commonly monitored Run keys or scheduled tasks. The binary contains shortcut-backup strings and references a VBScript launcher tied to the name VLCAssistant. The mechanism backs up the original shortcut (with a .backup extension) and rewrites the .lnk target so that opening it silently launches AvisLoader first, then chains into the original, legitimate application — preserving the appearance that nothing unusual happened.

This approach is deliberately chosen to blend in: most endpoint monitoring focuses on registry run keys, startup folders, and scheduled tasks, while modified desktop and taskbar shortcuts receive comparatively little scrutiny.

Phase 5 — Privilege Escalation and Process Hiding

A bundled helper binary, auto.exe, implements UACME method 41, which targets the ICMLuaUtil COM interface (CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}) to attempt silent UAC bypass and privilege elevation. Varonis notes the recovered artifacts do not confirm the bypass was successfully executed against a live target, but the code's presence signals clear operator intent to escalate privileges without triggering a UAC prompt.

A separate DLL, hmn_hook.dll, provides process-hiding functionality by hooking NtQuerySystemInformation — the Windows API used by Task Manager, Process Explorer, and many EDR agents to enumerate running processes — and filtering a specified process name out of the results. Exported functions HMN_HideStart, HMN_HideStatus, and HMN_HideStop suggest the operator can toggle this concealment on and off per session.

Phase 6 — The AvisLoader Command Center

The exposed staging server also hosted a web-based Command Center, giving Varonis visibility into the operator's management interface. The panel provides:

• A client dashboard showing online/offline status and geographic distribution of infected hosts
• A clients table listing hostname, country, CPU, GPU, installed antivirus product, administrator status, and the host's Tox public key
• Attribute-based task configuration, letting operators target commands by hardware profile, geography, or privilege level
• Remote shell-command execution against selected hosts
• File-staging capability for delivering additional payloads over the Tox channel

This gives operators a full inventory-and-tasking workflow comparable to commercial RMM tooling — but routed entirely over an encrypted P2P transport that resists conventional network-layer blocking.

Impact Assessment

Recommendations

For Security Operations

• Hunt for ClickFix patterns — alert on certutil.exe making outbound network connections, particularly to trycloudflare.com or other Cloudflare Quick Tunnel subdomains, immediately following a browser session
• Flag unexpected P2P/Tox traffic — Tox typically uses UDP on port 33445 (with TCP fallback); outbound traffic matching Tox protocol signatures from standard workstations is a high-fidelity anomaly in most enterprise environments
• Monitor workers.dev and trycloudflare.com referrals — these domains are increasingly abused as disposable, difficult-to-block lure and payload-hosting infrastructure
• Hunt for modified shortcuts — look for recently altered .lnk files on the desktop and in %AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar, accompanying .backup files, and references to VLCAssistant
• Investigate NtQuerySystemInformation hooking — EDR telemetry gaps where expected processes silently fail to enumerate can indicate hmn_hook.dll-style concealment

For Endpoint Defense

• Apply Attack Surface Reduction (ASR) rules blocking abuse of signed system utilities (such as certutil.exe) for file download and execution
• Restrict or monitor use of certutil.exe with -urlcache or similar download-capable flags via application control policies
• Enable tamper protection on shortcut files in managed environments where feasible, and baseline known-good shortcut hashes for critical applications
• Treat UACME-style COM elevation attempts (ICMLuaUtil, CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}) as a high-severity detection rule in EDR

For Users and Awareness Programs

• Never paste a "verification code" into a terminal, PowerShell, or the Windows Run dialog — no legitimate document-signing, CAPTCHA, or verification workflow requires this step
• Treat any page claiming "verification is handled by Cloudflare" that then asks for a pasted command as an immediate red flag and report it to security before proceeding
• Reinforce that DocuSign and similar e-signature platforms never require command-line interaction to view or sign a document

Key Takeaways

1. Tox P2P C2 removes the single point of failure defenders rely on — there is no domain or IP to sinkhole, and operators can relocate infrastructure by copying a save file, making traditional takedown playbooks far less effective.
2. ClickFix remains a highly effective initial-access vector — AvisLoader's DocuSign-themed lure shows the technique continuing to evolve and target enterprise document workflows specifically.
3. Shortcut hijacking is an under-monitored persistence mechanism — security teams that focus solely on Run keys and scheduled tasks will miss AvisLoader's .lnk-based foothold.
4. Decoy packer names are a deliberate anti-analysis trick — the presence of Themida/VMProtect/Enigma/UPX-named sections does not confirm those packers were used, and analysts should not take section names at face value.
5. The web-based Command Center gives operators RMM-like capabilities — host inventory, attribute-based tasking, remote shell execution, and file staging, all routed over encrypted P2P.
6. No confirmed in-the-wild exploitation yet, but the architecture is built for scale — organizations should treat this as a proactive detection-engineering opportunity before AvisLoader sees wider deployment.

Sources

• Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption — BleepingComputer
• Meet AvisLoader: A Windows Loader Built to Outlast a Takedown — Varonis