Security researchers have uncovered a new Windows loader malware called AvisLoader that’s engineered to stay operational even when its command-and-control servers are taken offline. By using a peer-to-peer network for instructions, it evades traditional disruption strategies that rely on disabling central domains or servers.
How AvisLoader Tricks Users
The malware campaign begins with a decoy: a document-signing page masquerading as a standard verification prompt. Victims are instructed to paste a command—purportedly for security checks or document authenticity—that, instead of completing a familiar browser download, sets up a tunnel to download and run malicious code silently. This ruse mirrors tactics seen in recent “ClickFix” operations and was discovered during an investigation of a staging server harboring lure files and an operator dashboard by threat analysts.
Peer-to-Peer Makes It More Durable
Unlike many malware loaders that depend on hard-coded server addresses, AvisLoader embeds the Tox peer-to-peer messaging protocol within its Windows executable. That means infected machines can still receive commands even if the operator’s server domain is seized or taken offline. Vendors advertising AvisLoader claim that operators can keep the same identity by transferring the Tox save file to a new host—maintaining continuity despite infrastructure disruption.
Stealth Features and Capabilities
The sample analyzed was a 3.4 MB, 64-bit Windows executable, running with whatever privileges the user launching it holds. Although it includes sections with names typical of commercial packers, there was no evidence confirming use of such packers. Intriguingly, the lure included instructions for macOS—but researchers found no Mac version of the payload.
To fly under the radar, AvisLoader can modify desktop and pinned taskbar shortcuts so that clicking them launches both the expected application and the hidden malware. It bundles a helper module tied to a known Windows privilege escalation bypass, and another supposed to hide malicious processes from system listings. However, neither of those features has been verified in actual target environments yet—it’s unclear how often they’re deployed in the field.
Detection, Indicators, and Mitigation
Security teams can’t rely solely on domain takedowns. Instead, sudden command-line commands coming from unexpected sources—or tunnels—along with unexplained peer-to-peer connections should be red flags. Modified shortcuts and odd helper files can also be telling signs. Examining system artifacts like backup files, local helper libraries or processes referencing known Windows functions tied to privilege bypass or process hiding is essential. Also, watch for associations with shared hosting or tunnel domains—which may appear benign but serve as launchpads in malicious contexts.
Below are known indicators of compromise (IoCs) tied to AvisLoader:
- Client executable (32-char SHA-256 hash): 78324.exe / 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc
- Elevation-bypass helper: auto.exe / f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975
- Process-hiding library: hmn_hook.dll / cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5
- Tox-based persistence via launcher named “VLCAssistant”
- Shortcut backup extension “.backup” for desktop/taskbar modifications
- DLL exports like HMN_HideStart, HMN_HideStatus, HMN_HideStop and hooked function NtQuerySystemInformation—associated with hiding processes
Avoid running commands copied from verification or document-signature pages, especially if pasted into a terminal or Run dialog. Follow up with forensic checks: script history, network connection anomalies, altered shortcuts, helper files, and odd tunnel or peer-to-peer traffic—these are all pieces of the puzzle.
As defenders evolve, so do attackers—and AvisLoader proves it. With infrastructure-resilient design built in, it’s not just another loader, but a signal that future malware may emphasize survival even when visible infrastructure is compromised. Monitoring decentralized control channels and validating what seems like innocuous documents or commands will be as crucial as ever. This is more than hype—it’s what upcoming threat landscapes are getting ready to require.
