{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 3, "direct_entities": 7, "direct_relationships": 6, "invalid_iocs": 0, "iocs": 3, "mentioned": 1, "mitre_associated": 0, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 43, "excluded_graph_objects": 90, "graph_complete": true, "graph_objects": 7, "graph_relationships": 6, "mitre_context_complete": true, "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "status_as_of": "2026-10-10T23:47:50+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T19:43:35.671Z", "updated_at": "2026-09-26T19:43:35.838Z" }, "description_available": false, "entity_type": "StixFile", "id": "255ff768-5685-454b-b7ca-5ff04e5a004a", "is_inferred": false, "labels": [ "avisloader", "clickfix", "cloudflare", "loader", "p2p c2", "persistence", "shortcut modification", "tox", "uac bypass" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "file--7853f189-a7cb-56d8-a5ed-c914c51c55a5", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T19:43:35.506Z", "updated_at": "2026-09-26T19:43:35.689Z" }, "description_available": false, "entity_type": "StixFile", "id": "3b3e73b1-74ef-4759-8995-1ba65f863ec8", "is_inferred": false, "labels": [ "avisloader", "clickfix", "cloudflare", "loader", "p2p c2", "persistence", "shortcut modification", "tox", "uac bypass" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "file--a4cfcf7e-0b67-5398-b734-44157d74051b", "type": "StixFile" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.755Z", "created_at": "2026-09-26T19:43:31.551Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T19:43:32.445Z", "updated_at": "2026-09-26T19:43:32.445Z" }, "description_available": false, "entity_type": "Malware", "id": "4c61bebb-c445-467c-aea3-b87714afd185", "is_inferred": false, "labels": [], "lang": "en", "name": "AvisLoader", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "malware--39d03ad2-b809-5b11-8527-fbb4a93279b5", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T19:43:35.484Z", "updated_at": "2026-09-26T19:43:35.666Z" }, "description_available": false, "entity_type": "StixFile", "id": "51756e12-7304-4e2d-a7b6-2a95ddb998f7", "is_inferred": false, "labels": [ "avisloader", "clickfix", "cloudflare", "loader", "p2p c2", "persistence", "shortcut modification", "tox", "uac bypass" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "file--b61586b3-f000-55f1-b9e1-c7102bbbad08", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.786Z", "created_at": "2026-09-26T19:43:36.517Z", "modified": "2026-09-26T19:44:09.001Z", "updated_at": "2026-09-26T19:44:09.001Z" }, "description_available": false, "entity_type": "Indicator", "id": "8752aa98-0b39-4698-ae0b-a12970cac08c", "is_inferred": false, "labels": [ "avisloader", "clickfix", "cloudflare", "loader", "p2p c2", "persistence", "shortcut modification", "tox", "uac bypass" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "indicator--ae71798c-9855-57c5-a9d3-32e4b4f4458b", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.780Z", "created_at": "2026-09-26T19:43:36.350Z", "modified": "2026-09-26T19:43:43.184Z", "updated_at": "2026-09-26T19:43:43.184Z" }, "description_available": false, "entity_type": "Indicator", "id": "a763bf75-ae66-4c65-8a9a-1f517d3e2a06", "is_inferred": false, "labels": [ "avisloader", "clickfix", "cloudflare", "loader", "p2p c2", "persistence", "shortcut modification", "tox", "uac bypass" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "indicator--242fc673-1f33-5389-aea9-6ac2e5757c3e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.783Z", "created_at": "2026-09-26T19:43:36.435Z", "modified": "2026-09-26T19:43:56.261Z", "updated_at": "2026-09-26T19:43:56.261Z" }, "description_available": false, "entity_type": "Indicator", "id": "dd0c1814-e172-4cea-851a-8e1f6caa40a9", "is_inferred": false, "labels": [ "avisloader", "clickfix", "cloudflare", "loader", "p2p c2", "persistence", "shortcut modification", "tox", "uac bypass" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "indicator--6bbf47f2-3b44-5877-b03a-26b4346b15d5", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.799Z", "created_at": "2026-09-26T19:45:46.471Z", "modified": "2026-09-26T19:45:46.831Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:45:46.831Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dd0c1814-e172-4cea-851a-8e1f6caa40a9", "from_id": "dd0c1814-e172-4cea-851a-8e1f6caa40a9", "from_name": null, "from_type": "Indicator", "id": "6c193217-1547-4673-ab1e-14682958a5b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "relationship--3cccc1a5-27cf-538f-8e67-21bd20eeb1ca", "toId": "4c61bebb-c445-467c-aea3-b87714afd185", "to_id": "4c61bebb-c445-467c-aea3-b87714afd185", "to_name": "AvisLoader", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.782Z", "created_at": "2026-09-26T19:45:23.320Z", "modified": "2026-09-26T19:45:24.069Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:45:24.069Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a763bf75-ae66-4c65-8a9a-1f517d3e2a06", "from_id": "a763bf75-ae66-4c65-8a9a-1f517d3e2a06", "from_name": null, "from_type": "Indicator", "id": "956b1cbf-fcf3-45c9-af0d-c4b3551588e3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "relationship--56458f03-e6fc-5186-89e0-f4f0d98efe16", "toId": "3b3e73b1-74ef-4759-8995-1ba65f863ec8", "to_id": "3b3e73b1-74ef-4759-8995-1ba65f863ec8", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.787Z", "created_at": "2026-09-26T19:45:24.953Z", "modified": "2026-09-26T19:45:25.720Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:45:25.720Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8752aa98-0b39-4698-ae0b-a12970cac08c", "from_id": "8752aa98-0b39-4698-ae0b-a12970cac08c", "from_name": null, "from_type": "Indicator", "id": "b445dc5e-7d03-405e-8e78-0c00eaa80e50", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "relationship--4c90379a-20c5-5414-acb5-f926309ba9f6", "toId": "255ff768-5685-454b-b7ca-5ff04e5a004a", "to_id": "255ff768-5685-454b-b7ca-5ff04e5a004a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.788Z", "created_at": "2026-09-26T19:45:26.033Z", "modified": "2026-09-26T19:45:27.222Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:45:27.222Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a763bf75-ae66-4c65-8a9a-1f517d3e2a06", "from_id": "a763bf75-ae66-4c65-8a9a-1f517d3e2a06", "from_name": null, "from_type": "Indicator", "id": "cb94be00-61cf-49fd-89c7-bb03632c30f5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "relationship--3f1fc8dd-3d83-5641-ab9e-736dd630055b", "toId": "4c61bebb-c445-467c-aea3-b87714afd185", "to_id": "4c61bebb-c445-467c-aea3-b87714afd185", "to_name": "AvisLoader", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.784Z", "created_at": "2026-09-26T19:45:24.701Z", "modified": "2026-09-26T19:45:25.721Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:45:25.721Z" }, "description_available": false, "entity_type": "based-on", "fromId": "dd0c1814-e172-4cea-851a-8e1f6caa40a9", "from_id": "dd0c1814-e172-4cea-851a-8e1f6caa40a9", "from_name": null, "from_type": "Indicator", "id": "dbff295a-8f3e-450e-be08-49e212cd64df", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "relationship--cf4e83be-107e-5d69-a6ce-898357839ff5", "toId": "51756e12-7304-4e2d-a7b6-2a95ddb998f7", "to_id": "51756e12-7304-4e2d-a7b6-2a95ddb998f7", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:11.809Z", "created_at": "2026-09-26T19:45:58.823Z", "modified": "2026-09-26T19:45:58.984Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:45:58.984Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8752aa98-0b39-4698-ae0b-a12970cac08c", "from_id": "8752aa98-0b39-4698-ae0b-a12970cac08c", "from_name": null, "from_type": "Indicator", "id": "dcfc9329-3aa7-45ab-b939-6121eee96b50", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "standard_id": "relationship--5061a5ef-65a0-5959-a3bb-4390150021ae", "toId": "4c61bebb-c445-467c-aea3-b87714afd185", "to_id": "4c61bebb-c445-467c-aea3-b87714afd185", "to_name": "AvisLoader", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc", "description_available": false, "object_id": "a763bf75-ae66-4c65-8a9a-1f517d3e2a06", "object_ids": [ "3b3e73b1-74ef-4759-8995-1ba65f863ec8", "a763bf75-ae66-4c65-8a9a-1f517d3e2a06" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a763bf75-ae66-4c65-8a9a-1f517d3e2a06", "valid_from": "2026-09-23T17:33:29.000Z", "valid_until": "2027-07-11T04:43:13.557Z", "validity_status": "active", "value": "35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "3b3e73b1-74ef-4759-8995-1ba65f863ec8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc" } ], "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "type": "sha256", "valid_from": "2026-09-23T17:33:29.000Z", "valid_until": "2027-07-11T04:43:13.557Z", "validity_status": "active", "value": "35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5", "description_available": false, "object_id": "dd0c1814-e172-4cea-851a-8e1f6caa40a9", "object_ids": [ "51756e12-7304-4e2d-a7b6-2a95ddb998f7", "dd0c1814-e172-4cea-851a-8e1f6caa40a9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "dd0c1814-e172-4cea-851a-8e1f6caa40a9", "valid_from": "2026-09-23T17:33:29.000Z", "valid_until": "2027-07-11T04:43:13.557Z", "validity_status": "active", "value": "cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "51756e12-7304-4e2d-a7b6-2a95ddb998f7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5" } ], "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "type": "sha256", "valid_from": "2026-09-23T17:33:29.000Z", "valid_until": "2027-07-11T04:43:13.557Z", "validity_status": "active", "value": "cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975", "description_available": false, "object_id": "8752aa98-0b39-4698-ae0b-a12970cac08c", "object_ids": [ "255ff768-5685-454b-b7ca-5ff04e5a004a", "8752aa98-0b39-4698-ae0b-a12970cac08c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8752aa98-0b39-4698-ae0b-a12970cac08c", "valid_from": "2026-09-23T17:33:29.000Z", "valid_until": "2027-07-11T04:43:13.557Z", "validity_status": "active", "value": "f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "255ff768-5685-454b-b7ca-5ff04e5a004a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975" } ], "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown", "type": "sha256", "valid_from": "2026-09-23T17:33:29.000Z", "valid_until": "2027-07-11T04:43:13.557Z", "validity_status": "active", "value": "f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975" } ], "mentioned": [ { "confidence": 50, "evidence_id": "4c61bebb-c445-467c-aea3-b87714afd185", "name": "AvisLoader", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-23T17:33:28.958Z", "created_at": "2026-09-26T19:46:13.527Z", "modified": "2026-09-26T19:46:14.658Z", "published": "2026-09-23T17:33:28.958Z", "updated_at": "2026-09-26T19:46:14.658Z" }, "description_available": true, "id": "febf14de-972d-4344-94eb-b783f7a0f693", "is_inferred": false, "labels": [ "avisloader", "clickfix", "cloudflare", "loader", "p2p c2", "persistence", "shortcut modification", "tox", "uac bypass" ], "lang": "en", "name": "Meet AvisLoader: A Windows Loader Built to Outlast a Takedown", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-23T17:33:28.958Z", "references": [ { "external_id": null, "id": "6069eecf-5d4e-4bc1-a13c-e7a1ffc08aca", "source_name": "alien-vault", "url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown" }, { "external_id": "6ab40d6887e7e948c6a09d80", "id": "7863b9d3-853a-4d70-bc2c-8825ba85c5c9", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6ab40d6887e7e948c6a09d80" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "febf14de-972d-4344-94eb-b783f7a0f693", "schema_version": 1, "selected_date": "2026-09-23", "source_url": "https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown" }