Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption

What happened

A new Windows malware (software written to damage a system or steal from it) loader called AvisLoader operates with encrypted peer-to-peer (machines connecting directly to each other, with no server in between) communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware operates with ClickFix (malware deployment method) delivery, shortcut-based persistence, and remote command execution capabilities.

Key facts

• A new Windows malware loader called AvisLoader — uses: encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt
• Varonis researchers explain how the malware — uses: ClickFix delivery, shortcut-based persistence, and remote command execution capabilities