Executive Summary
Varonis Threat Labs discovered AvisLoader, a novel Windows malware loader designed for high resilience against infrastructure takedowns. The loader distinguishes itself by utilizing the Tox encrypted peer-to-peer (P2P) protocol for command-and-control (C2) rather than traditional domain names or static IP addresses. This decentralized approach allows operators to maintain connectivity with infected clients even if their staging servers are seized or blocked.
The attack chain typically initiates via 'ClickFix' lures, which trick users into pasting malicious commands into a terminal under the guise of document verification (e.g., DocuSign). Once active, AvisLoader employs various techniques for stealth and persistence, including process hiding via rootkit functionality, UAC bypass mechanisms, and shortcut modification. A web-based 'Command Center' provides operators with granular control over infected hosts, allowing for targeted task execution based on hardware profiles and location.
AvisLoader represents a growing trend of utilizing legitimate P2P protocols to blend malicious traffic with normal encrypted communications. The tool's modularity and reliance on P2P infrastructure make it a potent threat for initial access, capable of delivering secondary payloads while remaining difficult to neutralize via standard network-level blocking.