Meet AvisLoader: A Windows Loader Built to Outlast a Takedown
Varonis Threat Labs discovered AvisLoader, a new Windows malware loader built to keep its command-and-control (C2) channel beyond the reach of traditional domain takedowns.
Varonis Threat Labs recently discovered AvisLoader, a new Windows loader named after the Latin word for bird. We found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center.
The attack starts with a familiar ClickFix lure. A page posing as a document-signing request asks visitors to copy and run an attacker-supplied command on their machine.
The more interesting part is how AvisLoader stays connected. It communicates via Tox, an encrypted peer-to-peer (P2P) messaging network that carries commands and additional payloads from the operator.
That setup makes traditional domain-based takedowns harder. The command-and-control (C2) channel does not depend on a fixed domain or server address, and operators can keep the same identity when moving to another server.
The seller references...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
