AvisLoader-chain shell exec and payload drop to user-writable paths

Arnold Chan@slaz

•updated Sep 25, 2026•1•0•3

Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.