5 minhigh
Meet AvisLoader: A Windows Loader Built to Outlast a Takedown
AvisLoader is a Windows loader using Tox P2P for C2, delivered via ClickFix lures, with shortcut persistence and a bundled UAC bypass. AvisLoader uses the Tox encrypted P2P messaging protocol for command-and-control, making domain-based takedowns ineffective. It is delivered through ClickFix lures mimicking DocuSign and includes shortcut modification persistence, a UAC bypass helper, and a process-hiding DLL.
Sens:▲ 24hConf:high
IOCs8
3sha2562domain2email1file path
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block the identified SHA-256 hashes across endpoint controls
- Block trycloudflare.com tunnel URL and 847823.cn domain
- Hunt for modified shortcuts with .backup files and VLCAssistant references
- Isolate hosts showing Tox P2P traffic with unexpected process lineage
Key Takeaways
- Tox P2P protocol removes single-domain C2 dependency; operators move by copying a Tox save file.
- Loader is a 3.4 MB 64-bit executable with 17 decoy packer section names to confuse analysis.
- Persistence modifies desktop and taskbar shortcuts, launching malware via a VBScript named VLCAssistant.
- auto.exe implements UACME method 41 (ICMLuaUtil COM elevation) for potential privilege escalation.
- hmn_hook.dll hooks NtQuerySystemInformation to filter a specified process name from results.
- Command Center panel supports shell tasking, file delivery over Tox, and client filtering by hardware and location.
Attack Chain
- Initial Access: ClickFix lure on Cloudflare Workers mimics DocuSign, tricks user into pasting command
- Execution: Pasted command downloads and executes 78324.exe from trycloudflare.com tunnel
- Persistence: Modifies desktop and taskbar shortcuts to launch malware via VLCAssistant VBScript
- Defense Evasion: auto.exe attempts UACME method 41 bypass; hmn_hook.dll hooks NtQuerySystemInformation to hide processes
- C2: Loader acts as Tox P2P client, receiving commands and files from operator
- Discovery and Exfiltration: Command Center tasks shell commands and delivers payloads over Tox
Affected Systems
- Windows desktops and laptops
- Users interacting with DocuSign-themed phishing pages
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Shortcut modifications, process hooking, and UAC bypass attempts are visible via EDR telemetry. |
| Network Visibility | Medium | Tox P2P traffic is observable but encrypted; no fixed domain to block. |
| Detection Difficulty | Moderate | Behavioral indicators are clear but Tox traffic and ClickFix delivery lack fixed infrastructure. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Script interpreters downloading and executing code from trycloudflare.com tunnels following browser activity (T1204.004) | Process creation, command-line, network connections | Initial Access | Medium — legitimate dev tunnels exist |
| Desktop or taskbar shortcuts modified with .backup files and VLCAssistant references (T1547.009) | File system events, shortcut file changes | Persistence | Low — rare in enterprise environments |
| Process hooking of NtQuerySystemInformation by unsigned DLL hmn_hook.dll (T1014) | API hooking detection, module load events | Defense Evasion | Low — uncommon in standard operations |
| Unexpected Tox P2P network connections from user workstations (T1071) | Network flow, TLS, firewall logs | Command and Control | Medium — Tox has legitimate uses |
Required Log Sources
- Process creation and command-line logging
- File creation and modification events
- Shortcut file modification events
- DNS and HTTP/TLS proxy logs
- Registry and COM object access logs
Key Behavioral Indicators
- Shortcut files with .backup extension and VLCAssistant references
- Process spawning from modified shortcut with VBScript launcher
- Unsigned DLL hooking NtQuerySystemInformation
- auto.exe referencing COM CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
- Tox P2P traffic from non-Tox applications
- Command shell execution without browser parent process
Control Gaps
- Domain-based C2 blocking ineffective against Tox P2P
- Signature-based AV may miss decoy packer sections
- Network inspection limited by Tox encryption
- UAC bypass may succeed on unpatched systems
False Positive Assessment
Medium — trycloudflare.com and workers.dev have legitimate uses; Tox protocol is used for benign messaging; shortcut modifications occur during normal software installs.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block outbound Tox protocol traffic from enterprise endpoints
- Monitor and filter trycloudflare.com and workers.dev URLs in proxy logs
- Enable UAC enforcement on all Windows endpoints
User Protection
- Deploy EDR rules for shortcut modification and process hooking
- Block emails from docusign-secure-delivery.net and 847823.cn
- Warn users about DocuSign-themed verification prompts requesting terminal commands
Security Awareness
- Train users to report document-signing pages asking them to paste commands into terminals
- Advise users that legitimate DocuSign requests never require running terminal commands
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping6 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Command and Control
Additional IOCs
- Domains:
847823[.]cn- Domain used in phishing email sender and contact addresses
- File Paths:
C:\Users\dev\Desktop\c-toxcore- Embedded developer build path in loader
- Command Lines:
- Purpose: Download and execute initial payload from Cloudflare Quick Tunnel | Tools:
sh| Stage: Initial Access |curl | sh
- Purpose: Download and execute initial payload from Cloudflare Quick Tunnel | Tools:
- Other:
VLCAssistant- Persistence-related VBScript launcher name.backup- Shortcut backup extension created during persistence{3E5FC7F9-9A51-4367-9063-A120244FBEC7}- COM CLSID referenced by auto.exe for UAC bypass
Showing defanged values
- domain847823[.]cnDomain used in phishing email sender and contact addresses
- domaindocusign-secure-delivery[.]netDomain used for sending DocuSign-themed phishing emails
- emailhello[@]847823[.]cnSender address for DocuSign-themed phishing lure
- emailsupport[@]847823[.]cnContact email in phishing lure
- file_pathC:\Users\dev\Desktop\c-toxcoreEmbedded developer build path in loader
- sha25635dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2ccAvisLoader Windows client (78324.exe)
- sha256cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5Bundled process-hiding library (hmn_hook.dll)
- sha256f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975Bundled elevation-bypass helper (auto.exe)
