> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Tracking PavinLoader across ClickFix and fake download campaigns - URL: https://f4n6.co.uk/security-feed/tracking-pavinloader-across-clickfix-and-fake-download-campaigns/ - Published: 2026-08-24T20:51:20.000Z - Updated: 2026-08-24T20:51:20.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Malwarebytes tracking identifies PavinLoader, a multi-stage .NET loader, as a shared infrastructure component across disparate initial access vectors including ClickFix fake CAPTCHAs, malicious RenPy game installs, and fake software downloads. The loader abuses legitimate Windows tooling (MSBuild, .csproj, .bat) and uses the EtherHiding technique — storing C2 addresses on the Binance Smart Chain blockchain — to complicate infrastructure takedown. In observed campaigns, PavinLoader delivers Amatera Stealer 4.2.3-alpha1, an information stealer targeting credentials, cryptocurrency wallets, and browser data. EMEA financial services face direct risk of credential theft and session hijacking from employees encountering these lures, and the potential Loader-as-a-Service (LaaS) model suggests this threat will persist across multiple independent campaigns. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain Attribution for PavinLoader is unconfirmed; no MITRE actor profile has been resolved for this item. Malwarebytes assesses with medium confidence that PavinLoader may be offered as a Loader-as-a-Service (LaaS) based on shared compilation artifacts across 200+ files and builder scripts found on VirusTotal containing comments like `EDIT HERE` and `REPLACE with a real direct link to your .bat`, though no build panel or sales channels have been identified. The following attack chain is reconstructed from Malwarebytes analysis (single-sourced; verify before enforcement). 1. **Initial Access:** Victims are lured via ClickFix (fake CAPTCHA instructing the user to run a command), fake software downloads (via Dropbox and Cloudflare buckets), or malicious RenPy game installers. In some cases, Inno Setup or MSI installers are used to execute the first stage. 2. **Execution via MSBuild:** The infection chain abuses MSBuild to execute trojanized .NET DLLs. For example, a malicious MSI (`Installer_57be78.msi`) drops a legitimate MSBuild executable renamed as `prefetch_2f76.exe` alongside a `.csproj` file. The command executed is: `"C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.exe" /nologo "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.csproj" /nr:false` 3. **Loader DLL Execution:** The Loader DLL is a trojanized legitimate DLL (e.g., DotNetZip, Nancy, Renci.SshNet, OpenXML). Malicious methods follow a `TwoWords` or `TwoWordsNumber` naming pattern (e.g., `DefaultEvaluator5`, `FallbackFactory5`). It is executed via the `UsingTask` element in the .csproj file or via MSI `CustomAction`. 4. **Obfuscation & Anti-Analysis:** The .NET DLLs use a custom obfuscator featuring control-flow flattening, custom bytecode, indirect calls (`calli`/`ldftn`), string encryption, API hashing, and delegates. The loader patches AMSI and ETW (`AmsiScanString`, `EtwEventWriteNtQueryInformationProcess`, `NtSetInformationThread`, `VirtualProtect`). 5. **C2 Resolution via EtherHiding:** The EtherHiding Loader retrieves the C2 domain by making an ETH RPC call to `bsc-dataseed.binance.org` targeting smart contract `0x328a1fadff154290f0ce1389a4e633633698cdfdaa7` with data `0x06fdde03`. 6. **Stage Retrieval:** Subsequent stages are downloaded from the resolved C2 via HTTP requests using paths like `assets/{two random words}.json`. Responses are JSON-wrapped, XOR-encoded payloads under `cache.content`. HMAC validation is used for requests, generating `X-Timestamp`, `X-Nonce`, and `X-Signature` headers. 7. **Anti-Analysis DLL:** Before payload delivery, an anti-analysis DLL executes. It checks system LCID against 17+ languages (RU, UA, BY, AM, etc.) and queries IP reputation services (`ipleak.net`, `geojs.io`, `ipapi.co`, `ipapi.is`, `ipinfo.io`) to block hosting providers and specific regions. It also enumerates firmware tables and PCI vendor IDs to detect virtualization (VMware, VirtualBox, QEMU, etc.). 8. **Payload Delivery:** The final payload observed is an obfuscated **Amatera Stealer 4.2.3-alpha1** disguised as `WPA.exe`. It is loaded via a custom PE loader (GollopDevest DLL). Amatera uses the Heaven’s Gate technique, DNS-over-HTTPS (DoH) via Google DNS, and raw sockets (`\Device\Afd\Endpoint`). Additional payloads, including HijackLoader, have been observed downloaded from C2 IPs post-infection. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Network Blocking:** Block traffic to the identified PavinLoader C2 domains and IPs. Focus on the TLDs commonly used: `.lat`, `.icu`, `.shop`, `.cfd`, `.pro`. - **EDR/Hunting:** Hunt for MSBuild executing from non-standard paths (e.g., `AppData\Local\Logitech\Device Configuration Helper\`, `AppData\Local\Conexant\`). Specifically, alert on `MSBuild.exe` or renamed MSBuild binaries executing `.csproj` or `.cmd`/`.bat` files. - **Process Monitoring:** Block and alert on `conhost.exe --headless cmd.exe /c` execution patterns originating from `AppData` directories. ### P2 — Within 72 hours - **Endpoint Restrictions:** Restrict the execution of MSBuild.exe and `conhost.exe` from user-writable directories. Ensure application whitelisting policies (e.g., AppLocker, WDAC) cover `AppData\Local` paths. - **AMSI/ETW Validation:** Ensure AMSI and ETW are functioning correctly on endpoints, as PavinLoader attempts to patch these defensively; EDR should alert on attempts to patch `AmsiScanString` or `EtwEventWriteNtQueryInformationProcess`. - **Blockchain RPC Inspection:** Monitor and potentially block unauthorized ETH RPC calls to `bsc-dataseed.binance.org` from standard user workstations, as this indicates EtherHiding C2 resolution. ### P3 — Within 7 days - **User Awareness:** Warn users about ClickFix attacks (fake CAPTCHAs prompting PowerShell/cmd execution) and fake software download lures. - **Email/Web Filtering:** Block the identified dead-drop URL (`telegra[.]ph`) and review proxy logs for traffic to the IP reputation services abused for anti-analysis (`ipleak.net`, `geojs.io`, `ipapi.co`, `ipapi.is`, `ipinfo.io`) if those are not standard business tools. ## 5\. Indicators of compromise | type | value | confidence | source | | ------ | ---------------------------------------------------------------- | ---------- | ------------ | | sha256 | bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c | High | Malwarebytes | | sha256 | e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9 | High | Malwarebytes | | sha256 | a4f03272cf96732dc9f58bb466d16f358e7f50d46dba30526a9fbebfec11717b | High | Malwarebytes | | sha256 | bf04160dd1ce3571e0eb6d6dda1713c788797b5599399d4a93665a757eec376e | High | Malwarebytes | | sha256 | 54fa8083c05334aa360256fbbb0ca901ce7e244a0359dd664cae78977371ec91 | High | Malwarebytes | | sha256 | c1ea6d169565c70ac5d812e73483814929e9b3548ead6633595937e71a334adb | High | Malwarebytes | | sha256 | 001337488c32d8610c2aef6f9330acca825f0afacd071bf6ebfc06b5a1a69f09 | High | Malwarebytes | | sha256 | 2837099af431e9afee76ce5e6ab5cb86bedce06e31c22be46250cb453cfdb978 | High | Malwarebytes | | sha256 | 252c5a3d150275013f52b4820097d7163ced4aa2f1be0fca032f8a5017673816 | High | Malwarebytes | | sha256 | 0c9c64b7383ec249bcf6271a4b73206d94de130ca401d16ab77fe01e5193a312 | High | Malwarebytes | | sha256 | 6700f62e1a3b33340cd678c388ecc8bac2e5943c0627df5d1b99b879c3ca42c9 | High | Malwarebytes | | ipv4 | 93.152.224\[.\]75 | High | Malwarebytes | | ipv4 | 65.21.80\[.\]170 | High | Malwarebytes | | ipv4 | 195.63.142\[.\]49 | High | Malwarebytes | | domain | perfectverified\[.\]com | High | Malwarebytes | | domain | catalyst-pro\[.\]lat | High | Malwarebytes | | domain | twigoamwu\[.\]cfd | High | Malwarebytes | | domain | trusaifi\[.\]cfd | High | Malwarebytes | | domain | stellar-minds\[.\]cfd | High | Malwarebytes | | domain | pinnacle-labs\[.\]lat | High | Malwarebytes | | domain | nexahub\[.\]lat | High | Malwarebytes | | domain | fimwoglea\[.\]shop | High | Malwarebytes | | domain | velodium\[.\]lat | High | Malwarebytes | | domain | rpcsecnoweb\[.\]pro | High | Malwarebytes | | domain | more-arpc\[.\]icu | High | Malwarebytes | | domain | echo-systems\[.\]cfd | High | Malwarebytes | | domain | kelemet\[.\]shop | High | Malwarebytes | | domain | zarwieciv\[.\]cfd | High | Malwarebytes | | url | hxxps://telegra\[.\]ph/Project-PySynth-06-28 | High | Malwarebytes | ```iocs sha256 bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c sha256 e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9 sha256 a4f03272cf96732dc9f58bb466d16f358e7f50d46dba30526a9fbebfec11717b sha256 bf04160dd1ce3571e0eb6d6dda1713c788797b5599399d4a93665a757eec376e sha256 54fa8083c05334aa360256fbbb0ca901ce7e244a0359dd664cae78977371ec91 sha256 c1ea6d169565c70ac5d812e73483814929e9b3548ead6633595937e71a334adb sha256 001337488c32d8610c2aef6f9330acca825f0afacd071bf6ebfc06b5a1a69f09 sha256 2837099af431e9afee76ce5e6ab5cb86bedce06e31c22be46250cb453cfdb978 sha256 252c5a3d150275013f52b4820097d7163ced4aa2f1be0fca032f8a5017673816 sha256 0c9c64b7383ec249bcf6271a4b73206d94de130ca401d16ab77fe01e5193a312 sha256 6700f62e1a3b33340cd678c388ecc8bac2e5943c0627df5d1b99b879c3ca42c9 ipv4 93.152.224[.]75 ipv4 65.21.80[.]170 ipv4 195.63.142[.]49 domain perfectverified[.]com domain catalyst-pro[.]lat domain twigoamwu[.]cfd domain trusaifi[.]cfd domain stellar-minds[.]cfd domain pinnacle-labs[.]lat domain nexahub[.]lat domain fimwoglea[.]shop domain velodium[.]lat domain rpcsecnoweb[.]pro domain more-arpc[.]icu domain echo-systems[.]cfd domain kelemet[.]shop domain zarwieciv[.]cfd url hxxps://telegra[.]ph/Project-PySynth-06-28 ``` ## 6\. Detection ```yara rule PavinLoader_Artifacts { meta: author = "Adverse Trace" date = "2026-08-24" reference = "https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns" description = "Detects PavinLoader builder artifacts and distinctive strings" strings: $builder1 = "EDIT HERE" nocase $builder2 = "REPLACE with a real direct link to your .bat" nocase $builder3 = "Automated builder helper" nocase $pe_loader1 = "GollopMailers LDR DllBase VeneryCondole EdiyaFoully=0x{0:X} EdiyaStelae=0x{1:X}" nocase $pe_loader2 = "GollopMailers LDR Flags missing IMAGE_DLL 0x{0:X8}" nocase $pe_loader3 = "GollopMailers LDR SaranPisco invalid 0x{0:X}" nocase $pe_loader4 = "GollopMailers LDR TlsIndex invalid {0}" nocase $pe_loader5 = "GollopMailers LDR sanity exception: " nocase $pe_loader6 = "LdrpHandleTlsData outside ntdll .text" nocase $pe_loader7 = "LdrpReleaseTlsEntry outside ntdll .text" nocase $pe_loader8 = "Required API resolve failed: type={0}, FreshBubals={1}, module=0x{2:X}" nocase $fake_comment = "BUILD VERIFICATION REPORT" nocase condition: 3 of them } ``` ```yaml title: PavinLoader MSBuild Execution from AppData id: 7a9c2e1f-8b4d-4e3a-9f5c-1d2e3f4a5b6c status: experimental description: Detects MSBuild or conhost executing from AppData paths, consistent with PavinLoader infection chains author: Adverse Trace date: 2026/08/24 references: - https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns logsource: product: windows category: process_creation detection: selection_msbuild: Image|endswith: - '\MSBuild.exe' - '\prefetch_*.exe' CommandLine|contains: - '\AppData\Local\' - '.csproj' - '/nologo' selection_conhost: Image|endswith: '\conhost.exe' CommandLine|contains|all: - '--headless' - 'cmd.exe /c' - '\AppData\Local\' selection_env_var: CommandLine|contains: 'MSBUILDENABLEALLPROPERTYFUNCTIONS=1' condition: selection_msbuild or selection_conhost or selection_env_var fields: - Image - CommandLine - ParentImage falsepositives: - Legitimate software development builds executed from user profiles (rare in enterprise environments) level: high ``` ## 7\. Sources - Malwarebytes — Tracking PavinLoader across ClickFix and fake download campaigns — https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns — 2026-08-24 - Malwarebytes Labs — Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding — https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-games-spread-stealers-with-renpy-loader-msbuild-and-etherhiding — 2026-07 ## 8\. Adverse Trace position PavinLoader represents a maturing, multi-vector loader threat with credible indicators of a Loader-as-a-Service model, increasing the likelihood of widespread deployment against EMEA financial sector employees via social engineering. The use of EtherHiding for C2 resolution significantly complicates infrastructure takedown, and the delivery of Amatera Stealer poses a direct risk to session tokens and credentials. As this analysis is currently single-sourced from Malwarebytes, we are treating the LaaS attribution as unconfirmed. We will continue to track PavinLoader artifacts across additional telemetry feeds and will update clients if independent confirmation of the LaaS model or new campaign clusters emerges. --- [Read the original source →](https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*