AvisLoader is a Windows malware loader designed to persist even after server takedowns This article explores avisloader windows malware. . It begins with a fake document-signing page that prompts visitors to run a command themselves, turning a common verification request into a potential infection on the device.

The DocuSign-themed deception with a fake verification prompt (Source – Varonis) Researchers did not observe a successful takedown and recovery, so the resilience described here is a design feature and seller claim. A Cloudflare tunnel supplies code; Tox carries later instructions.

Indicators of compromise (IoCs): Type Indicator Description File and SHA-256 78324.exe / 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc AvisLoader Windows client File and SHA-256 auto.exe / f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975 Bundled elevation-bypass helper File and SHA-256 hmn_hook.dll / cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5 Bundled process-hiding library Domain workers.dev Shared hosting domain to investigate when associated with a suspicious signing lure; not inherently malicious Domain trycloudflare.com Shared tunnel domain to investigate when associated with a suspicious download command; not inherently malicious Launcher name VLCAssistant Persistence-related launcher name File extension .backup Shortcut backup extension relevant alongside modified shortcuts Build path C:\Users\dev\Desktop\c-toxcore Developer path embedded in the loader DLL exports HMN_HideStart, HMN_HideStatus, HMN_HideStop Exports of the recovered process-hiding library Hooked function NtQuerySystemInformation Legitimate Windows function targeted by the process-hiding library COM class identifier {3E5FC7F9-9A51-4367-9063-A120244FBEC7} Identifier referenced by the elevation-bypass helper Restrict alerts to controlled threat intelligence platforms like MISP, VirusTotal, or your SIEM.