Loading malware…
AvisLoader is a 64-bit Windows malware loader advertised on a cybercrime forum. It statically embeds c-toxcore and uses the encrypted Tox peer-to-peer network to receive operator commands and additional payloads. This architecture reduces dependence on a fixed command-and-control domain or centralized server address, although its network traffic remains observable.
Its associated delivery chain uses a DocuSign-themed ClickFix lure hosted through Cloudflare Workers. A fake Cloudflare verification dialog persuades visitors to paste and execute a command in a terminal, retrieving code through a Cloudflare Quick Tunnel rather than the browser's normal download workflow. The recovered payload targets Windows; no corresponding macOS payload was identified.
AvisLoader supports persistence by modifying desktop and taskbar-pinned shortcuts so that a script launcher starts the malware before opening the intended application. Its command center supports host profiling, including hardware, geographic location, antivirus software, and administrator status. Operators can select clients by these attributes, prepare shell-command tasks for execution when clients connect, and stage additional files for delivery over Tox. An accompanying process-hiding library can hook Windows system-information queries and filter a selected process from enumeration results. The loader inherits its launching process's privileges rather than requesting elevation at startup.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
"Its task controls can prepare shell commands for selected computers when they connect."
The web-based AvisLoader Command Center gives attackers a list of infected computers and details such as their location, hardware, antivirus software and administrator status.
Intègre statiquement c-toxcore, l’implémentation de référence du protocole Tox (P2P chiffré), pour les communications C2.
"AvisLoader instead uses Tox, a messaging network where computers communicate as peers" and embeds the Tox software directly.
AvisLoader uses Tox, a peer-to-peer messaging network that does not rely on a fixed command-and-control domain or server address.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A 64-bit Windows loader discovered on an exposed staging server alongside a document-signing-themed ClickFix lure and supporting tools. It uses the Tox peer-to-peer protocol for encrypted operator communications, shell commands, and additional payload delivery, reducing dependence on fixed C2 domains or server addresses. Recovered artifacts indicate shortcut-based persistence designed to launch the malware before opening the intended application. Its Command Center supports host inventory, client selection by hardware, location and administrator status, queued shell tasks, and file distribution. Associated helpers provide potential UAC bypass and process hiding, but the recovered files do not establish successful elevation or that AvisLoader itself was hidden.
Loader Windows 64 bits diffusé via un leurre ClickFix imitant une demande de signature DocuSign. Il utilise le protocole P2P chiffré Tox, via c-toxcore statiquement intégré, pour le C2 et la livraison de charges additionnelles. Il établit une persistance par modification de raccourcis, contourne l’UAC avec UACME méthode 41 et emploie un composant de dissimulation de processus hookant NtQuerySystemInformation.
A Windows loader and remote-access payload delivered through DocuSign-themed ClickFix-style fake verification pages. Victims are induced to manually execute a command that retrieves code through a Cloudflare tunnel. The loader embeds Tox for resilient peer-to-peer command-and-control and payload delivery, supports operator migration through a Tox save file, can prepare shell-command tasks, and includes capabilities for shortcut modification, privilege-bypass attempts, and process hiding.
A 64-bit Windows loader delivered through a fake DocuSign ClickFix page. It statically links c-toxcore to use the Tox P2P network for resilient command-and-control, provides operators with system reconnaissance, remote shell-command execution, and additional-file delivery. It is designed to persist by modifying desktop and taskbar shortcuts; recovered components also include a possible UAC-bypass utility and a DLL capable of concealing selected processes.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.