AvisLoader Uses Tox to Keep Windows Malware Connected

Varonis Threat Labs says it recently discovered AvisLoader, a Windows malware loader that uses the encrypted peer-to-peer messaging network Tox to communicate with its operators. The researchers found it on an exposed staging server alongside a ClickFix lure, supporting tools, and a control panel.

The lure imitated a DocuSign signing request and asked visitors to paste a command into a terminal. That command retrieved and ran code through a Cloudflare Quick Tunnel address. Although the lure displayed a macOS command, the recovered files contained a Windows payload; researchers found no corresponding macOS payload.

The payload is a 3.4 MB, 64-bit executable. Its manifest specifies asInvoker, so it inherits the launching process’s privileges and does not request User Account Control (UAC) elevation at startup. Varonis also found 17 same-sized sections with names linked to packers such as Themida, VMProtect, Enigma, and UPX, but says those names alone do not show that the packers were used.

AvisLoader uses Tox rather than relying on a fixed command-and-control domain or server address. Its persistence code targets desktop and taskbar shortcuts. Recovered tools also include auto.exe, which references method 41 from the UACME bypass project, and hmn_hook.dll, which can filter a specified process from results returned by a Windows function. The files do not establish that elevation succeeded or that the DLL hid AvisLoader from Task Manager.

The AvisLoader Command Center includes client, task, and file-management interfaces. Varonis says its findings point to monitoring the initial ClickFix command, shortcut changes, and unexpected Tox traffic.