A new OTX pulse published by AlienVault and sourced from Varonis research documents AvisLoader, a previously unseen Windows malware loader engineered specifically to survive law-enforcement and registrar-level takedowns. Instead of relying on traditional domain- or IP-based command-and-control, AvisLoader routes all C2 traffic through the Tox protocol — an encrypted, peer-to-peer messaging network with no central servers to seize, sinkhole, or blocklist.
The attack chain begins with the ClickFix social engineering technique, which has surged across crimeware operations over the past year. Victims landing on a compromised or malicious page are presented with a fake "document verification" or "prove you're human" prompt that instructs them to copy a command and paste it into the Windows Run dialog or a terminal. That single user-driven paste action executes the initial stager — typically via mshta.exe, powershell.exe, or wscript.exe — pulling down the AvisLoader payload.
Once resident, AvisLoader establishes persistence through shortcut (LNK) modification in user startup paths and performs a UAC bypass to elevate privileges without triggering a consent prompt. Cloudflare infrastructure is abused along the delivery chain to front staging servers and blend malicious downloads into legitimate CDN traffic. The loader's end objective is payload delivery: operators use it as initial-access infrastructure to stage follow-on tooling such as stealers, RATs, and ransomware precursors.
The strategic implication for defenders is significant: because C2 rides an encrypted P2P mesh, DNS-layer and domain-reputation controls are largely ineffective post-infection. Detection must shift to execution behavior, persistence artifacts, and the ClickFix initial-access pattern.
Threat Actor / Malware Profile
Family: AvisLoader (attribution: unknown — no public actor cluster yet claimed) Type: Windows loader / initial-access malware
Distribution method: ClickFix social engineering. Victims are instructed to copy a malicious command disguised as a verification step and execute it manually, bypassing many attachment- and URL-filtering controls because the user — not the malware — initiates execution.
Payload behavior: The stager retrieves the loader binary (frequently via Cloudflare-fronted endpoints to defeat domain blocking), writes it to user-writable paths, and prepares the environment for secondary payload delivery. As a loader, its value to operators is modular: it fetches and executes whatever the C2 pushes next.
C2 communication: Tox encrypted peer-to-peer protocol. Tox uses DHT-based node discovery and end-to-end encrypted messaging over UDP/TCP (default port 33445). There is no central domain or server — blocking individual nodes does not degrade the network. This is a deliberate takedown-resilience design choice and a marked shift from the HTTP/HTTPS C2 most enterprise controls are tuned to catch.
Persistence mechanism: Shortcut modification — LNK files in Startup folders or frequently used shortcut locations are rewritten so their target chains a legitimate executable with the loader, re-triggering infection on user logon or application launch.
Privilege escalation / anti-analysis: UAC bypass techniques are used to gain elevated execution without user consent prompts. Combined with encrypted P2P C2 and CDN-fronted staging, the loader minimizes forensic and network-monitoring visibility.
IOC Analysis
This pulse contains 3 SHA-256 file hashes — no network indicators (IPs/domains/URLs), which is consistent with the P2P C2 design: there are no stable C2 domains to publish.
35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cccd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975
How to operationalize:
- EDR/AV blocklisting: Push all three hashes into your EDR block policy (Defender for Endpoint indicator API, CrowdStrike custom IOC, SentinelOne blacklist). Hash-based blocking is your highest-confidence control here given the absence of network IOCs.
- Retro-hunt: Query 30 days of
DeviceFileEvents/DeviceProcessEventsfor these hashes across all endpoints — a loader already resident may have delivered secondary payloads. - Email/web gateway tuning: Block or alert on Cloudflare-fronted downloads of executables from recently registered or low-reputation origins, and flag pages containing ClickFix-style clipboard-injection JavaScript (
navigator.clipboard.writeText). - Network detection for Tox: Alert on UDP/TCP 33445 traffic and Tox DHT bootstrap node connections from end-user workstations — Tox has virtually no legitimate enterprise use.
Because the IOC set is hash-only, behavioral detection (below) is the durable control — hashes rotate with every recompile.
Detection Engineering
---
title: ClickFix-Style User-Driven Stager Execution (Run Dialog / Clipboard-Pasted Command)
id: 9f1c2a44-avis-0001-4b7e-9d2a-clickfix01
status: experimental
description: Detects AvisLoader initial access via ClickFix technique — child processes spawned from explorer.exe via the Run dialog or short-lived paste-execution of mshta/powershell/wscript/rundll32 with download or encoded arguments.
author: Security Arsenal Threat Intel
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\explorer.exe'
selection_lolbin:
Image|endswith:
- '\mshta.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
- '\curl.exe'
selection_args:
CommandLine|contains:
- 'http://'
- 'https://'
- 'FromBase64String'
- 'enc '
- '-e '
- 'IEX'
- 'DownloadString'
- 'Invoke-WebRequest'
condition: selection_parent and selection_lolbin and selection_args
falsepositives:
- Rare legitimate admin paste-execution; ClickFix pattern is strongly anomalous from explorer.exe parents
level: high
tags:
- attack.initial_access
- attack.t1204
- attack.t1059
---
title: Tox P2P Protocol Network Activity from Workstation Process
id: 9f1c2a44-avis-0002-4c8f-a3b1-toxc2p2p02
status: experimental
description: Detects network connections to Tox DHT bootstrap nodes or default Tox port (33445) indicative of AvisLoader P2P C2 communication. Tox has no legitimate enterprise use case.
author: Security Arsenal Threat Intel
logsource:
category: network_connection
product: windows
detection:
selection_port:
DestinationPort: 33445
selection_bootstrap:
DestinationHostname|contains:
- 'tox.initramfs.io'
- 'tox.abilinski.com'
- 'tox.novg.net'
- 'toxnode'
- 'bootstrap'
filter_common:
Image|endswith:
- '\svchost.exe'
condition: (selection_port or selection_bootstrap) and not filter_common
falsepositives:
- Legitimate Tox/qTox messaging clients installed by users (uncommon in enterprise; verify via software inventory)
level: critical
tags:
- attack.command_and_control
- attack.t1090
- attack.t1571
---
title: Shortcut (LNK) Modification for Persistence in Startup Locations
id: 9f1c2a44-avis-0003-4d9b-b5c2-lnkpersist03
status: experimental
description: Detects creation or modification of LNK files in Startup folders or shortcut targets chained with script interpreters — AvisLoader persistence via shortcut modification.
author: Security Arsenal Threat Intel
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
- '\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\'
selection_ext:
TargetFilename|endswith: '.lnk'
filter_signed:
Image|endswith:
- '\msiexec.exe'
- '\setup.exe'
condition: selection_path and selection_ext and not filter_signed
falsepositives:
- Legitimate installers adding startup shortcuts; correlate with unsigned or user-profile-resident Image paths
level: high
tags:
- attack.persistence
- attack.t1547.001
- attack.t1204
// AvisLoader hunt: ClickFix execution, Tox P2P C2, and known hashes
// Microsoft Sentinel / Defender XDR
let AvisHashes = dynamic([
"35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc",
"cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5",
"f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975"
]);
let ClickFix = (
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("mshta.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","rundll32.exe","curl.exe")
| where ProcessCommandLine has_any ("http://","https://","FromBase64String","IEX","DownloadString","Invoke-WebRequest")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, ReportId
| extend Detection = "ClickFix-Style Execution"
);
let ToxC2 = (
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemotePort == 33445
or RemoteUrl has_any ("tox.initramfs.io","tox.abilinski.com","tox.novg.net","toxnode")
| where InitiatingProcessFileName !in~ ("svchost.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ReportId
| extend Detection = "Tox P2P C2 Traffic"
);
let HashHits = (
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 in~ (AvisHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend Detection = "AvisLoader Hash Match"
);
union ClickFix, ToxC2, HashHits
| sort by TimeGenerated desc
# AvisLoader endpoint hunt: persistence, hashes, UAC artifacts, and Tox network indicators
$hashes = @(
"35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc",
"cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5",
"f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975"
)
Write-Host "`n[*] Checking Startup-folder LNK persistence..." -ForegroundColor Cyan
$startupDirs = @(
"$env:APPDATA",
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.