Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
Summary
A new Windows malware loader named AvisLoader has been identified, designed to be resistant to disruption through encrypted peer-to-peer communication for its command-and-control infrastructure. Researchers detailed its methods, including ClickFix delivery, shortcut-based persistence, and remote command execution.
IFF Assessment
FOE
AvisLoader's advanced evasion and persistence techniques make it a significant threat to defenders.
Defender Context
Defenders should be aware of AvisLoader's sophisticated C2 communication methods, which can complicate takedown efforts. Organizations should strengthen endpoint detection and response capabilities to identify and block its delivery and persistence mechanisms, particularly those involving shortcut manipulation.