AvisLoader: A New Peer-to-Peer Malware on the Rise

Introduction to AvisLoader

Varonis Threat Labs has recently identified an emerging threat in the cyber landscape known as AvisLoader, a sophisticated Windows malware loader designed to resist traditional disruption methods. Named after the Latin word for bird, AvisLoader leverages innovative techniques for communication and delivery, making it a significant concern for security teams worldwide.

Found on an exposed staging server, this loader operates in tandem with a ClickFix lure that initiates the attack. This strategy incorporates a spoofed document-signing request that urges users to execute attacker-provided commands on their machines.

Malware Delivery and Command Center Details

The ClickFix Lure

The specific ClickFix lure associated with AvisLoader was creatively designed to mimic a legitimate document-signing request from DocuSign. The lure features a fake “Manual verification” dialog box asserting that verification is managed by Cloudflare and instructing visitors to input a “verification code” into their terminal. This deceptive interface leads to a command that downloads and runs malicious software from a Cloudflare Quick Tunnel link.

Notably, while the lure displays a macOS command, the actual files recovered contained a Windows loader, indicating potential misdirection or cross-platform compatibility in delivery tactics.

Activation Process and Command Center Functionality

AvisLoader's command structure utilizes Tox, an encrypted peer-to-peer messaging network to communicate control commands and additional payloads. This unique setup complicates traditional takedown strategies since it permits attackers to switch between servers without losing connection to their clients. Operators can transport their identities by simply copying a Tox save file, allowing clients to follow without needing a designated domain.

The AvisLoader Command Center serves as a comprehensive management platform for operators. This dashboard allows capability management across multiple clients. Key functionalities include:

• Configuration of shell commands sent to targeted clients based on specific hardware and geographical attributes.
• File delivery mechanisms that utilize Tox for secure distribution.
• Dashboard insights such as total and online client counts alongside a world map for geographical tracking.

Understanding the Loader's Mechanics

The AvisLoader payload is characterized by its size (a single 3.4 MB 64-bit executable) and its operational design. It employs asInvoker privilege in its manifest, which means it runs with the privileges of the process that initiated it, sidestepping User Account Control (UAC) elevation requests. This aspect further embeds the loader into its environment undetected.

Structurally, its section table contains seventeen sections, all the same size and associated with names of well-known packers like Themida and VMProtect, seemingly to frustrate detection efforts. However, it does not confirm the actual usage of these packers.

Persistence and Stealth Techniques

AvisLoader incorporates several tactics to maintain persistence and stealth within a compromised system. It targets desktop and taskbar shortcuts by embedding backup strings and utilizes a VBScript launcher labeled VLCAssistant. This mechanism is designed to initiate the malware each time a modified shortcut is accessed, subsequently launching the intended application to disguise any malicious activity.

Furthermore, it includes a small helper program named auto.exe that attempts to bypass UAC restrictions by referencing method 41 from a known project called UACME. While this feature acts as a potential elevation method, the effectiveness of such actions in updated Windows environments remains unclear.

Process-Hiding Capabilities

Another critical component is the hmn_hook.dll, which offers process-hiding functionality. By hooking into the NtQuerySystemInformation function, it can filter results to exclude certain processes from visibility, complicating detection by security tools attached to the Windows environment. However, evidence to confirm whether this DLL is actively utilized to hide AvisLoader processes remains inconclusive.

Interactions and Indicators for Security Teams

To counteract threats posed by AvisLoader, security teams can monitor several indicators, from initial lure interactions to monitoring for unexpected traffic. Here are recommended steps for detection:

• Treat any document-signing or verification requests that prompt users to input commands into a terminal as suspicious.
• Investigate unlink Cloudflare Workers and trycloudflare.com addresses if they appear alongside actions leading to code execution.
• Monitor command shells or script interpreters that download remote code, especially if triggered by visits to suspicious websites.
• Watch for unusual Tox or peer-to-peer network traffic on affected devices, as this may indicate malicious activities.

Conclusion: Insights Gained from AvisLoader

AvisLoader highlights an evolution in malware tactics, merging familiar attack techniques with the capabilities of the Tox protocol. As a result, the malware’s landscape is shifting, with traditional signatures and behavioral analyses becoming increasingly ineffective. Expanding security protocols to include thorough monitoring of encrypted peer-to-peer communications is essential for contemporary security measures against malware like AvisLoader.

Key Takeaways

• AvisLoader uses Tox, a peer-to-peer network, for resilient command-and-control communication.
• The malware disguises itself through a deceptive ClickFix lure designed to look like a legitimate document signing request.
• The 3.4 MB Windows loader operates with minimal privileges and employs various persistence techniques.
• Security teams can enhance their detection capabilities by monitoring for unusual command prompts and Tox traffic.