DEV Community

Anoymask
Anoymask

Posted on

AvisLoader: A Windows Malware Loader Combining Cloudflare ClickFix and Tox P2P C2

#security #threatintel

1. Basic Information

2. Executive Summary

Varonis recovered AvisLoader, a Windows loader that uses Tox for command and control, alongside a ClickFix lure page disguised as DocuSign. The lure page instructs users to run a macOS command, but the delivery path to the recovered Windows loader has not been confirmed.

3. Attack Flow

Configuration Confirmed from Recovered Artifacts (Delivery Continuity Unconfirmed)

  • The DocuSign-themed page hosted on Cloudflare Workers simulates manual verification, asks the user to paste and run a macOS command, and retrieves code from trycloudflare.com.
  • Although a Windows version of AvisLoader was located in the same recovered directory, no delivery path from the lure page commands to this loader was identified, and no matching macOS payload was found.
  • The Windows loader and auxiliary files contain features related to shortcut tampering, User Account Control (UAC) bypass, and process information hooking. The management panel provides Tox-based shell tasks and file delivery, but individual infections, privilege escalation, and successful delivery remain unconfirmed.

4. Attacker Positioning and Execution Location

  • A remote attacker distributes the ClickFix lure while operating Cloudflare infrastructure and Tox peers. Initial execution requires user command execution.

5. Visibility for Victims and Administrators

  • Users: Appears as a manual verification step before viewing a DocuSign document. After pasting the command, the intended application opens, making it difficult to notice anything unusual.
  • Administrators: Manifests as a shell spawned after browser activity, trycloudflare downloads, a 3.4MB x64 executable, shortcuts and .backup files, VLCAssistant, and Tox traffic.

6. Conditions for Success and Failure

Conditions for Success

  • The user pastes and executes the attacker-supplied command.
  • The Windows version of AvisLoader is delivered to the target endpoint and executed. The delivery path from the recovered macOS lure page is unconfirmed.
  • Tox P2P communication and persistence artifact creation are permitted on the endpoint.

Conditions for Failure and Countermeasures

  • Refrain from running verification steps that require pasting commands into the terminal or Run dialog.
  • Control remote code retrieval from shells, unapproved Quick Tunnels, Tox traffic, and shortcut modifications.

7. What Happens upon Success

  • Loader execution on the Windows host and operator shell tasks.
  • Additional malware delivery, shortcut persistence, and UAC bypass attempts.
  • Resistance to domain takedowns via P2P C2.

8. Observable Logs

The following items are candidates for investigation within your organization. Distinguish between facts observed in public intelligence and telemetry that must be verified internally.

  • Email: Check for DocuSign-themed link delivery, senders, URL rewrites, and click telemetry.
  • Proxy / SWG / DNS: Check for workers.dev and trycloudflare.com lure and download activities, as well as Tox bootstrap and relay traffic.
  • Endpoint / EDR: Check for shells and PowerShell execution, downloaded executables, VLCAssistant, auto.exe, hmn_hook.dll, and shortcut or .backup modifications.
  • Identity / IdP: Check for credential usage following malware execution, UAC events, and admin token usage.
  • SaaS / Cloud: Check email gateways, browser security, Cloudflare abuse reports, and EDR incidents.
  • Network: Check for Tox P2P connections, Cloudflare Quick Tunnels, additional payload downloads, and data egress.

9. Determining Attack Success

Confirmed in Public Intelligence

  • Initial Execution and Compromise Unconfirmed: Varonis recovered and analyzed the lure page, Windows loader, auxiliary files, and command center from a publicly accessible staging server. This represents functional analysis of recovered artifacts rather than reports confirming user execution and subsequent compromise in victim environments.

Internal Assessment Criteria

  • Criteria: Confirm AvisLoader execution on target endpoints using process, file, and network activity records. The mere presence of capabilities in recovered artifacts does not indicate successful infection or privilege escalation.
  • Correlate requests, responses, processes, authentication, data access, and egress chronologically to separate contact from success.
  • Do not infer success solely from a single alert without supporting intelligence.

10. Investigation Playbook

  • Investigation Starting Point: Start from terminal paste instructions, trycloudflare downloads, Tox traffic, and VLCAssistant shortcuts.
  • Initial Checks: Review the accessed URL, clipboard commands, shell history, download URLs, file hashes, and user execution.
  • Endpoint / Server Inspection: Preserve the process tree, shortcuts, .backup files, scheduled tasks, startup entries, auto.exe, hmn_hook.dll, and memory.
  • Identity / Cloud Inspection: Check for local admin activity, UAC elevation, browser and wallet credentials, and remote sessions.
  • Subsequent Activity: Track Tox commands, additional payloads, credential access, lateral movement, and data exfiltration.
  • Containment: Isolate the host, restrict Tox and Quick Tunnels, quarantine artifacts, rotate credentials, and restore shortcuts.
  • Classification: Distinguish between lure views, pasted commands, loader execution, persistence, C2 establishment, and additional payloads.

11. Defense and Detection Ideas

  • Single Events: Investigate external code retrieval via a shell following suspicious page visits, VLCAssistant activity, shortcut backup creation, and unusual Tox traffic from endpoints.
  • Chronological Correlation: Correlate visits to ClickFix lure pages, pasted commands, and external code retrieval with AvisLoader execution, shortcut modifications, and Tox traffic on Windows endpoints. Confirm the continuity of both paths using separate evidence.
  • Threat Hunting: Search for workers.dev or trycloudflare.com domains, the string C:\Users\dev\Desktop\c-toxcore, auto.exe, hmn_hook.dll, and .backup shortcuts.
  • Log Limitations: Pasted commands may not always be captured as browser child processes, meaning process parent-based detection alone can lead to blind spots.
  • Prioritized Countermeasures: Prioritize user education, shell egress controls, Tox policies, shortcut File Integrity Monitoring (FIM), and EDR behavioral rules.

12. Facts / Inference / Hypothesis

Facts

  • Varonis Threat Labs recovered AvisLoader, ClickFix lures, supporting tools, and a Command Center from an exposed staging server.
  • The DocuSign-themed lure page was designed to request pasting and running a macOS command, which then retrieved code from trycloudflare.com. Although a Windows loader was located in the same recovery directory, the continuity of the delivery path remains unconfirmed.
  • The recovered payload is a 3.4MB 64-bit Windows executable with an asInvoker manifest.
  • Seventeen identically sized sections bear names such as Themida, VMProtect, Enigma, and UPX, though this does not constitute proof that those packers were actually used.
  • The loader statically links c-toxcore and uses Tox P2P to receive commands and additional payloads.
  • Shortcut backups and the VLCAssistant VBScript point to a persistence design utilizing desktop and taskbar shortcut modifications.
  • auto.exe references UACME method 41 and the ICMLuaUtil COM elevation method, but this does not guarantee success on updated Windows systems.
  • Public reports are based on staging server and artifact analysis; actual damage or successful infections have not been confirmed.

Inference

  • Because Tox identities can be migrated via save files, domain takedowns alone are unlikely to permanently sever the operator's channel.
  • Correlating pasted commands—which lack browser parent processes—with trycloudflare downloads can cover blind spots in standard web download detections.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in section 14, "Unresolved Questions and Further Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1204.004 Malicious Copy and Paste high False verification steps instruct users to paste and execute commands.
T1105 Ingress Tool Transfer high Payloads are retrieved from trycloudflare.com.
T1547.009 Shortcut Modification medium Shortcut backups and VLCAssistant artifacts indicate a persistence design.
T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control medium auto.exe implements and references UAC bypass techniques, though successful elevation is unconfirmed.
T1071 Application Layer Protocol medium The loader statically links c-toxcore and uses Tox for C2 communication.

14. Unresolved Questions and Further Investigation

  • AvisLoader operators, sales scale, actual infection counts, and final payloads.
  • Environments where shortcut persistence, UAC bypass, and process hooks in the recovered samples successfully execute.
  • Complete indicators for Tox peer identities and bootstrap/relay infrastructure.

15. Impact on SOCs and Organizations

Manually verified processes disguised as DocuSign or Cloudflare may also appear legitimate to organizations. SOC teams should cross-correlate shell or PowerShell execution immediately following browser visits, trycloudflare.com downloads, shortcut modifications, and Tox traffic, verifying any contextual differences from legitimate Cloudflare usage.

16. Summary by Target Audience

  • For SOCs: Correlate visits to ClickFix lure pages, pasted commands, and external code retrieval with AvisLoader execution, shortcut modifications, and Tox traffic on Windows endpoints. Confirm the continuity of both paths using distinct evidence.
  • For Administrators: Block and educate users against verification procedures that require pasting commands into terminals, and establish usage policies for Quick Tunnels and Tox.
  • For Users: Do not execute instructions to paste commands into terminals or the Run dialog, even on screens resembling DocuSign or Cloudflare, and report such requests.

Top comments (0)