Varonis found AvisLoader on exposed server

Varonis Threat Labs said it had found AvisLoader on an exposed staging server, together with a ClickFix lure, support tools and the malware’s web panel. The lure had posed as a request to sign a document and had pushed visitors to paste a command into a terminal.

That command retrieved code through a Cloudflare Quick Tunnel endpoint on trycloudflare.com. The Windows sample was a 3.4 MB 64-bit executable, and its manifest showed that it inherited the launching process’s privileges rather than asking for UAC elevation at start-up.

The file table carried seventeen extra sections of equal size with names borrowed from well-known packers, but that naming did not prove those packers had been used. The binary also linked c-toxcore, the reference implementation of Tox, and still contained a build path pointing to C:\Users\dev\Desktop\c-toxcore.

Varonis said Tox let the loader communicate with its controller as another peer, which removed dependence on a single fixed address, although the network traffic would still be visible on the device. The article also said a seller’s forum listing claimed the controller could be moved by copying a Tox save file.

For persistence, the code targeted desktop and taskbar shortcuts and used backup files and a VBScript launcher called VLCAssistant. Other recovered files included auto.exe, which referenced UACME method 41, and hmn_hook.dll, which hooked NtQuerySystemInformation to filter a chosen process name; the recovered files did not show either technique working in practice.