AvisLoader: How to Detect & Block Tox P2P Malware Loader Attacks

Executive Summary

Security researchers at Varonis Threat Labs have uncovered AvisLoader, a stealthy 64-bit Windows malware loader engineered specifically to resist infrastructure takedowns and automated detection. Advertised on cybercrime forums and deployed in active campaigns, AvisLoader repudiates traditional Command and Control (C2) models that rely on centralized domains or virtual private server (VPS) IP addresses. Instead, the malware statically compiles c-toxcore, embedding the decentralized, encrypted Tox peer-to-peer (P2P) protocol directly into the loader binary.

By utilizing Tox P2P communications, the threat actors ensure that conventional defensive countermeasures—such as DNS sinkholing, domain revocation, and firewall IP blocklists—are ineffective. The malware compromises target endpoints through ClickFix social engineering lures masquerading as electronic signature verification portals, escalates privileges via User Account Control (UAC) bypasses, achieves deep persistence by modifying legitimate .LNK shortcuts, and deploys rootkit-style user-mode API hooks to hide active processes from system utilities.

This threat intelligence dispatch provides an in-depth forensic breakdown of AvisLoader's attack chain, root-cause mechanics, MITRE ATT&CK technique mappings, validated detection queries (Sigma, Microsoft Sentinel KQL, and Splunk SPL), and concrete SOC remediation runbooks.

---

Technical Vulnerability Analysis & Attack Chain

AvisLoader's intrusion lifecycle is divided into five modular stages designed to evade browser protections, bypass endpoint privilege boundaries, and establish an un-takedownable communication mesh:

1. Ingress via ClickFix Social Engineering: The campaign delivers malicious lures through fake DocuSign electronic signature prompts hosted on Cloudflare Workers. Victims are instructed to resolve a pseudo-verification error by pressing Win+R and executing a clipboard-copied PowerShell command that downloads the initial loader executable via Cloudflare Quick Tunnels (trycloudflare.com).
2. Privilege Elevation via UACME Method 41: Upon landing in staging directories (%TEMP%), the loader executes an auxiliary helper binary (auto.exe) that leverages an unquoted elevated COM interface (ICMLuaUtil) to achieve silent administrative privilege escalation.
3. Shortcut Modification & Persistence Hijacking: Rather than creating noisy Run keys or scheduled tasks, AvisLoader scans and modifies .lnk shortcut files on the victim's Desktop and pinned Taskbar. It backs up original files with a .backup extension and rewires the shortcut to launch a VBScript wrapper (VLCAssistant), which spawns AvisLoader in the background before launching the legitimate application.
4. Decentralized Tox P2P C2 Synchronization: The core loader binary bootstraps into the Tox DHT (Distributed Hash Table) network using embedded Tox public key IDs. Because communication is peer-to-peer and cryptographically routed, operators can seamlessly migrate controllers without reconfiguring bot clients.
5. API Hooking & Secondary Payload Delivery: AvisLoader deploys hmn_hook.dll into system memory to hook NtQuerySystemInformation, filtering out its own process identifier. It then listens for encrypted P2P tasks to execute arbitrary shell commands and drop secondary implants.

Root-Cause & Exploitation Mechanics

1. Ingress & Cloudflare Quick Tunnel Abuse

The initial execution relies on victim interaction engineered through ClickFix lures. When a target visits the phishing URL hosted on Cloudflare Workers, the page displays a simulated error dialog stating that a document signature verification failed. The victim is directed to copy a PowerShell payload into the Windows Run prompt (explorer.exe -> Run) or Windows Terminal.

The executed snippet bypasses standard browser file download reputation filters by invoking Invoke-WebRequest or curl.exe over Cloudflare Quick Tunnels (https://[random-subdomain].trycloudflare.com), staging the primary executable (e.g., 78324.exe) in %TEMP% or %LOCALAPPDATA%\Temp.

2. UAC Bypass via ICMLuaUtil COM Interface

To ensure administrative persistence, AvisLoader deploys auto.exe, a specialized UAC bypass tool derived from UACME (Technique 41). The binary exploits the auto-elevating COM interface ICMLuaUtil (CLSID {3E5FC7F9-9A51-4367-9063-A72EB411A1CF}):

CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
CLSIDFromString(L"{3E5FC7F9-9A51-4367-9063-A72EB411A1CF}", &clsid);
CoGetObject(ElevationMoniker, &bindOpts, IID_ICMLuaUtil, (void**)&pCMLuaUtil);
pCMLuaUtil->lpVtbl->ShellExec(pCMLuaUtil, TargetPayloadPath, NULL, NULL, SW_HIDE);

Because ICMLuaUtil operates within an auto-elevating COM server (dllhost.exe running under high integrity), invoking its ShellExec method executes AvisLoader with elevated administrative tokens while bypassing standard Windows UAC consent prompts on systems configured with default notification thresholds.

3. Desktop and Taskbar Shortcut (.LNK) Hijacking

To avoid standard auto-start inspection, AvisLoader implements shortcut weaponization across:

• %USERPROFILE%\Desktop\*.lnk
• %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\*.lnk
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\*.lnk

The malware reads each target shortcut, copies the original file to <AppName>.lnk.backup, and alters the shortcut's target path using the Windows IShellLink interface. Instead of pointing directly to chrome.exe or vlc.exe, the modified shortcut invokes the Windows Script Host:

wscript.exe //B "%LOCALAPPDATA%\Programs\Common\VLCAssistant.vbs" "C:\Program Files\Google\Chrome\Application\chrome.exe"

The VLCAssistant.vbs script performs two sequential actions:

1. Spawns the AvisLoader binary silently in the background without a console window.
2. Launches the original target binary passed in argument 0, ensuring normal user experience and masking the compromise.

4. Cryptographic C2 via Statically Linked c-toxcore

Traditional loaders rely on HTTP/HTTPS POST requests to dynamic DNS domains or static VPS IP addresses. AvisLoader bypasses centralized infrastructure entirely by statically linking c-toxcore, the reference C implementation of the peer-to-peer Tox protocol.

• Tox ID Structure: The loader client utilizes a 76-character hexadecimal Tox ID containing a 32-byte public key, a 4-byte anti-spam identifier, and a 2-byte checksum.
• DHT Routing: AvisLoader joins the Tox Distributed Hash Table (DHT) network by connecting to public bootstrap nodes over UDP. Once on the DHT, the bot initiates end-to-end encrypted tunnels (utilizing NaCl crypto_box / Curve25519, XSalsa20, and Poly1305) directly to the operator's controller Tox ID.
• Takedown Resilience: The operator's controller node can be moved across arbitrary cloud providers, residential proxies, or VPNs simply by copying the tox_save state file. Clients discover the operator dynamically across the DHT without modifying configuration files, preventing law enforcement seizures from disrupting bot communication.

5. Native API Hooking (NtQuerySystemInformation)

For defensive evasion, AvisLoader drops and injects hmn_hook.dll. The DLL modifies user-mode native API dispatch tables, specifically intercepting calls to:

• ntdll!NtQuerySystemInformation (System Information Class 0x05 - SystemProcessInformation)

When inspection utilities such as Windows Task Manager (taskmgr.exe), Process Explorer, or command-line scanners (tasklist.exe) query active system processes, the hooked function traverses the returned SYSTEM_PROCESS_INFORMATION linked list and unlinks the node matching AvisLoader's Process ID (UniqueProcessId), rendering the running loader invisible to routine local checks.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Campaign Attribution

AvisLoader represents a commercial malware loader sold on underground cybercrime forums targeting Windows corporate endpoints. Named after the Latin word for bird (avis), the tool is engineered as a persistent first-stage delivery vehicle for cybercrime syndicates and initial access brokers (IABs).

Varonis Threat Labs identified exposed staging infrastructure containing the AvisLoader Command Center, administrative builder tools, and staging repositories. The actor ecosystem demonstrates operational sophistication:

• Evasion-Focused Tooling: The integration of UACME bypasses, ClickFix delivery scripts, user-mode rootkits, and Tox P2P messaging indicates an architecture intentionally constructed to defeat automated sandbox detonations and infrastructure takedowns.
• Pay-Per-Install & Payload Flexibility: Threat actors deploy AvisLoader to stage secondary infostealers (e.g., Lumma, RedLine, Vidar) and establish beachheads for subsequent ransomware deployment.
• Decentralized Command Infrastructure: By relying on the Tox messaging network, operators eliminate the single point of failure inherent in bulletproof hosting and rogue domains.

---

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Step 1: Automated Audit and Restoration of Hijacked .LNK Shortcuts

Execute the following PowerShell administrative remediation script to detect hijacked shortcuts, terminate associated malicious runners, and restore original application targets from .backup files:

# AvisLoader LNK Shortcut Forensic Inspection and Remediation Script
$TargetDirs = @(
    [Environment]::GetFolderPath("Desktop"),
    "$env:APPDATA\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar",
    "$env:APPDATA\Microsoft\Windows\Start Menu\Programs"
)

$WScriptShell = New-Object -ComObject WScript.Shell

foreach ($Dir in $TargetDirs) {
    if (Test-Path $Dir) {
        $Shortcuts = Get-ChildItem -Path $Dir -Filter "*.lnk" -Recurse
        foreach ($Lnk in $Shortcuts) {
            $Parsed = $WScriptShell.CreateShortcut($Lnk.FullName)
            if ($Parsed.TargetPath -match "(wscript|cscript|powershell|cmd).exe" -and $Parsed.Arguments -match "(VLCAssistant|.vbs)") {
                Write-Warning "Compromised LNK Shortcut Detected: $($Lnk.FullName)"
                Write-Output "Malicious Arguments: $($Parsed.Arguments)"
                
                # Check for companion backup file
                $BackupPath = "$($Lnk.FullName).backup"
                if (Test-Path $BackupPath) {
                    Write-Output "Restoring original shortcut from $BackupPath..."
                    Remove-Item -Path $Lnk.FullName -Force
                    Move-Item -Path $BackupPath -Destination $Lnk.FullName -Force
                } else {
                    Write-Error "No backup file found for $($Lnk.FullName). Flagged for manual review."
                }
            }
        }
    }
}

Step 2: Enforce UAC "Always Notify" via Group Policy / Registry

Neutralize UACME Method 41 (ICMLuaUtil COM elevation) by requiring interactive user credentials/consent for all elevation requests:

# Enforce Maximum UAC Consent Prompt Behavior (Always Notify)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 2 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Value 1 -Type DWord
Write-Output "UAC consent prompt successfully set to Always Notify (Level 4)."

Step 3: Disable Windows Script Host (WSH) Execution for Standard Users

Prevent weaponized .vbs launchers from executing when shortcuts are clicked:

# Disable WScript and CScript via Machine Registry
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" -Name "Enabled" -Value 0 -Type DWord
Write-Output "Windows Script Host globally disabled."

---

2. Network & Perimeter Defenses

1. Block Cloudflare Quick Tunnel Domains: Enforce egress web filtering to drop outbound HTTP/HTTPS requests to *.trycloudflare.com on standard enterprise workstations. Legitimate administrative tunnels should require explicit corporate access tokens.
2. Filter Tox DHT Protocol Ports and Entropy: Configure edge firewalls and Next-Generation Firewalls (NGFWs) to block outbound UDP connections on typical Tox bootstrap ports (UDP 33445, UDP 3389, and UDP 8443) unless explicitly sanctioned.
3. Inspect DNS & High-Volume UDP Connections: Deploy deep packet inspection (DPI) to identify high-frequency UDP socket creation initiated by non-browser desktop processes, alerting on anomalous decentralized protocol handshakes.

---

3. Endpoint Detection & Hunting Query

Sigma Rule: LNK Shortcut Hijacking Spawning Script Interpreters

title: Suspicious LNK Shortcut Spawning Script Interpreter
id: 9a7b5d12-8e43-4f91-bc10-91a5e128ef31
status: experimental
description: Detects Windows shortcuts executing wscript.exe or cscript.exe with VBScript arguments, indicative of AvisLoader shortcut persistence.
references:
    - https://www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/
author: CyberNewsAI Threat Research Team
date: 2026-10-12
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - 'explorer.exe'
    selection_interpreter:
        Image|endswith:
            - 'wscript.exe'
            - 'cscript.exe'
    selection_arguments:
        CommandLine|contains:
            - 'VLCAssistant'
            - '.vbs'
            - 'ProgramsCommon'
            - 'AppDataLocalTemp'
    condition: selection_parent and selection_interpreter and selection_arguments
falsepositives:
    - Rare legacy administrative shortcut scripts
level: high
tags:
    - attack.persistence
    - attack.t1547.009
    - attack.execution
    - attack.t1059.005

Microsoft Sentinel / Defender KQL Hunting Query

// Hunt for AvisLoader ICMLuaUtil UAC Bypass and Shortcut Hijacking Artifacts
let lookback = 7d;
let SuspectScripts = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("VLCAssistant", ".vbs", "trycloudflare.com")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
let SuspectLnkModifications = DeviceFileEvents
| where TimeGenerated >= ago(lookback)
| where FileName endswith ".lnk.backup" or (FileName endswith ".lnk" and FolderPath has "TaskBar")
| where ActionType in ("FileCreated", "FileModified")
| project TimeGenerated, DeviceName, AccountName, ActionType, FileName, FolderPath, InitiatingProcessFileName;
SuspectScripts
| join kind=inner (SuspectLnkModifications) on DeviceName
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ActionType, FileName, FolderPath

Splunk SPL Hunting Query

index=windows sourcetype="WinEventLog:Security" EventCode=4688
(NewProcessName="*\wscript.exe" OR NewProcessName="*\cscript.exe")
(ProcessCommandLine="*VLCAssistant*" OR ProcessCommandLine="*.vbs*" OR ProcessCommandLine="*trycloudflare.com*")
| eval Host=Computer, User=Account_Name
| stats count earliest(_time) as first_seen latest(_time) as last_seen by Host, User, ParentProcessName, NewProcessName, ProcessCommandLine
| table first_seen, last_seen, Host, User, ParentProcessName, NewProcessName, ProcessCommandLine

---

SHA-256 Hashes

Network Infrastructure & Staging

File System & Forensic Artifacts