Meet AvisLoader: A Windows Loader Built to Outlast a Takedown

Varonis Threat Labs has identified AvisLoader, a new Windows malware loader designed to maintain its command-and-control (C2) connection beyond the reach of typical domain take-downs. Discovered on an exposed staging server alongside a phishing lure, supporting tools, and a command center, AvisLoader operates through a sophisticated peer-to-peer (P2P) messaging network called Tox.

This setup makes traditional domain-based takedowns more challenging, as the C2 channel does not rely on a fixed domain or server address. Instead, operators can move the controller by copying its Tox save file, allowing clients to follow without needing a domain.

Upon closer examination, the Windows loader is a 3.4 MB 64-bit executable that inherits the privileges of the process launching it without requesting User Account Control (UAC) elevation. The executable contains additional sections of identical size, associated with various packers, which may be intended to confuse packer identification efforts.

At its core, AvisLoader is a Tox client that communicates with its controller as another peer on the network. This communication method removes reliance on a single centralized command-and-control address but leaves network connections observable.

The loader's persistence mechanisms target shortcuts on the desktop and taskbar-pinned folder. It includes shortcut-backup strings and a VBScript launcher named VLCAssistant, designed to launch the malware when a user opens a modified shortcut while still appearing to open the intended application normally. The recovered files also include a small helper called auto.exe, which references a UAC bypass technique and warns about potential Windows version updates that may mitigate the bypass.

AvisLoader's command center, or the AvisLoader Command Center, provides operators with a web-based interface to manage clients, configure tasks, and distribute files. The dashboard displays counts of total, online, and offline clients, along with a world map. The Clients table includes fields for hostname, country, CPU, GPU, antivirus status, and administrator status, allowing operators to view host information in a single view.

The Tasks tab enables operators to configure shell commands and select clients based on hardware, location, and administrator status. Finally, the Files tab facilitates staging files and delivering additional payloads over Tox.