GajShield Threat Advisory — AvisLoader: Windows Malware Loader with Tox Peer-to-Peer Command and Control

Severity: High | Priority: 2

AvisLoader reaches victims through ClickFix social engineering. In the campaign Varonis observed, a page styled as DocuSign told users to copy and run a command on their computer. That command downloaded the loader through a Cloudflare tunnel.

Once running, AvisLoader communicates with its operators over Tox, an encrypted peer-to-peer messaging network. Because it doesn’t rely on a fixed domain or server, taking down a domain won’t cut off infected machines, and the operators can move their controller at will.

The loader:

• keeps itself running by modifying desktop and taskbar shortcuts, so it starts each time the user opens one of those shortcuts and then launches the expected application, which makes the change hard to notice;
• includes a helper that uses a publicly known Windows User Account Control bypass to try to gain administrator rights;
• includes a module that hides its processes.

Through the control panel, operators can run commands on infected computers and deliver further malware.

If GajAV detects AvisLoader or its components on a computer in your network:

• Treat the computer as compromised and isolate it.
• Find out how the file arrived, in particular whether the user recently ran a command copied from a web page, such as a document-signing or verification prompt.
• Check desktop and taskbar shortcuts for changed targets.
• Look for other malware the operators may have delivered.
• From a different, trusted device, change the passwords for accounts used on that computer.
• If you can’t be sure the computer is clean, reinstall Windows.

Detection of the UAC-bypass helper means the attackers tried to gain administrator rights, so also review the computer for new accounts, services and scheduled tasks.

Remind staff never to paste commands from a website into the Windows Run box, Command Prompt or PowerShell, whatever the page claims. Legitimate services such as DocuSign never ask users to do this. Where possible, restrict the use of Tox and other unapproved peer-to-peer messaging applications on company computers.