FHN 
AvisLoader is a Windows malware loader designed to remain controllable even when its main servers or websites are taken down.
The malware uses a fake document-signing or verification page to trick users into running a command themselves. What looks like a routine security check can instead download and execute malicious code on the computer.
The campaign uses a technique similar to ClickFix-style attacks, where victims are instructed to copy and paste a command into their system.
Researchers from Varonis Threat Labs found AvisLoader on an exposed staging server containing the malware, supporting files, and an operator dashboard.
AvisLoader Uses Peer-to-Peer Communication
Many malware campaigns depend on a fixed website or server to send commands to infected computers. Taking down that infrastructure can disrupt communication.
AvisLoader takes a different approach.
The malware includes the Tox peer-to-peer messaging system inside its Windows executable. This allows infected computers to communicate without depending on a single fixed control domain.
A cybercrime forum seller also claimed that the malware’s controller could be moved by transferring a Tox save file, allowing clients to continue communicating with the same operator identity.
Researchers did not confirm an actual takedown followed by recovery, so this resilience remains a designed capability and seller claim, rather than confirmed real-world behavior.
The malware still leaves signs that security teams can investigate. Its infrastructure uses a Cloudflare tunnel to deliver code, while Tox handles later communication.
The recovered dashboard could display infected-system information such as devices, security software, and administrator status. It also included options for sending commands and additional files.
Malware Can Modify Windows Shortcuts
The recovered AvisLoader sample is a 64-bit Windows executable of about 3.4 MB and runs with the privileges of the user who launches it.
Researchers found code capable of modifying desktop and taskbar shortcuts. A changed shortcut could start the malware before opening the application the user expected, helping the activity blend into normal behavior.
The sample also contained a helper associated with a known Windows privilege-bypass technique and another library capable of hiding selected processes from process listings.
However, these findings show potential capabilities, not confirmed successful attacks against victims.
How to Detect and Avoid the Attack
Users should be cautious of websites that ask them to paste commands into PowerShell, Command Prompt, Terminal, or the Windows Run dialog as part of a verification process.
Security teams should investigate:
- Unexpected command or script execution
- Suspicious peer-to-peer network traffic
- Modified desktop or taskbar shortcuts
- Unusual cloud-hosted connections
- Unknown helper files and backup artifacts
Cloud services should not automatically be blocked because they can have legitimate uses. Instead, security teams should correlate the website, command execution, system changes, and network activity to identify suspicious behavior.
A fake verification step may look harmless, but asking users to execute commands manually can turn them into an active part of the infection process.
IoCs
| Type | Indicator | Description |
|---|---|---|
| File and SHA-256 | 78324.exe / 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc | AvisLoader Windows client |
| File and SHA-256 | auto.exe / f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975 | Bundled elevation-bypass helper |
| File and SHA-256 | hmn_hook.dll / cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5 | Bundled process-hiding library |
| Domain | workers.dev | Shared hosting domain to investigate when associated with a suspicious signing lure; not inherently malicious |
| Domain | trycloudflare.com | Shared tunnel domain to investigate when associated with a suspicious download command; not inherently malicious |
| Launcher name | VLCAssistant | Persistence-related launcher name |
| File extension | .backup | Shortcut backup extension relevant alongside modified shortcuts |
| Build path | C:\Users\dev\Desktop\c-toxcore | Developer path embedded in the loader |
| DLL exports | HMN_HideStart, HMN_HideStatus, HMN_HideStop | Exports of the recovered process-hiding library |
| Hooked function | NtQuerySystemInformation | Legitimate Windows function targeted by the process-hiding library |
| COM class identifier | {3E5FC7F9-9A51-4367-9063-A120244FBEC7} | Identifier referenced by the elevation-bypass helper |
About the Author
