Tracking PavinLoader across ClickFix and fake download campaigns

1. Executive summary

Malwarebytes tracking identifies PavinLoader, a multi-stage .NET loader, as a shared infrastructure component across disparate initial access vectors including ClickFix fake CAPTCHAs, malicious RenPy game installs, and fake software downloads. The loader abuses legitimate Windows tooling (MSBuild, .csproj, .bat) and uses the EtherHiding technique — storing C2 addresses on the Binance Smart Chain blockchain — to complicate infrastructure takedown. In observed campaigns, PavinLoader delivers Amatera Stealer 4.2.3-alpha1, an information stealer targeting credentials, cryptocurrency wallets, and browser data. EMEA financial services face direct risk of credential theft and session hijacking from employees encountering these lures, and the potential Loader-as-a-Service (LaaS) model suggests this threat will persist across multiple independent campaigns.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

Attribution for PavinLoader is unconfirmed; no MITRE actor profile has been resolved for this item. Malwarebytes assesses with medium confidence that PavinLoader may be offered as a Loader-as-a-Service (LaaS) based on shared compilation artifacts across 200+ files and builder scripts found on VirusTotal containing comments like EDIT HERE and REPLACE with a real direct link to your .bat, though no build panel or sales channels have been identified. The following attack chain is reconstructed from Malwarebytes analysis (single-sourced; verify before enforcement).

1. Initial Access: Victims are lured via ClickFix (fake CAPTCHA instructing the user to run a command), fake software downloads (via Dropbox and Cloudflare buckets), or malicious RenPy game installers. In some cases, Inno Setup or MSI installers are used to execute the first stage.
2. Execution via MSBuild: The infection chain abuses MSBuild to execute trojanized .NET DLLs. For example, a malicious MSI (Installer_57be78.msi) drops a legitimate MSBuild executable renamed as prefetch_2f76.exe alongside a .csproj file. The command executed is: "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.exe" /nologo "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.csproj" /nr:false
3. Loader DLL Execution: The Loader DLL is a trojanized legitimate DLL (e.g., DotNetZip, Nancy, Renci.SshNet, OpenXML). Malicious methods follow a TwoWords or TwoWordsNumber naming pattern (e.g., DefaultEvaluator5, FallbackFactory5). It is executed via the UsingTask element in the .csproj file or via MSI CustomAction.
4. Obfuscation & Anti-Analysis: The .NET DLLs use a custom obfuscator featuring control-flow flattening, custom bytecode, indirect calls (calli/ldftn), string encryption, API hashing, and delegates. The loader patches AMSI and ETW (AmsiScanString, EtwEventWriteNtQueryInformationProcess, NtSetInformationThread, VirtualProtect).
5. C2 Resolution via EtherHiding: The EtherHiding Loader retrieves the C2 domain by making an ETH RPC call to bsc-dataseed.binance.org targeting smart contract 0x328a1fadff154290f0ce1389a4e633633698cdfdaa7 with data 0x06fdde03.
6. Stage Retrieval: Subsequent stages are downloaded from the resolved C2 via HTTP requests using paths like assets/{two random words}.json. Responses are JSON-wrapped, XOR-encoded payloads under cache.content. HMAC validation is used for requests, generating X-Timestamp, X-Nonce, and X-Signature headers.
7. Anti-Analysis DLL: Before payload delivery, an anti-analysis DLL executes. It checks system LCID against 17+ languages (RU, UA, BY, AM, etc.) and queries IP reputation services (ipleak.net, geojs.io, ipapi.co, ipapi.is, ipinfo.io) to block hosting providers and specific regions. It also enumerates firmware tables and PCI vendor IDs to detect virtualization (VMware, VirtualBox, QEMU, etc.).
8. Payload Delivery: The final payload observed is an obfuscated Amatera Stealer 4.2.3-alpha1 disguised as WPA.exe. It is loaded via a custom PE loader (GollopDevest DLL). Amatera uses the Heaven’s Gate technique, DNS-over-HTTPS (DoH) via Google DNS, and raw sockets (\Device\Afd\Endpoint). Additional payloads, including HijackLoader, have been observed downloaded from C2 IPs post-infection.

4. Mitigation & containment

P1 — Within 24 hours

• Network Blocking: Block traffic to the identified PavinLoader C2 domains and IPs. Focus on the TLDs commonly used: .lat, .icu, .shop, .cfd, .pro.
• EDR/Hunting: Hunt for MSBuild executing from non-standard paths (e.g., AppData\Local\Logitech\Device Configuration Helper\, AppData\Local\Conexant\). Specifically, alert on MSBuild.exe or renamed MSBuild binaries executing .csproj or .cmd/.bat files.
• Process Monitoring: Block and alert on conhost.exe --headless cmd.exe /c execution patterns originating from AppData directories.

P2 — Within 72 hours

• Endpoint Restrictions: Restrict the execution of MSBuild.exe and conhost.exe from user-writable directories. Ensure application whitelisting policies (e.g., AppLocker, WDAC) cover AppData\Local paths.
• AMSI/ETW Validation: Ensure AMSI and ETW are functioning correctly on endpoints, as PavinLoader attempts to patch these defensively; EDR should alert on attempts to patch AmsiScanString or EtwEventWriteNtQueryInformationProcess.
• Blockchain RPC Inspection: Monitor and potentially block unauthorized ETH RPC calls to bsc-dataseed.binance.org from standard user workstations, as this indicates EtherHiding C2 resolution.

P3 — Within 7 days

• User Awareness: Warn users about ClickFix attacks (fake CAPTCHAs prompting PowerShell/cmd execution) and fake software download lures.
• Email/Web Filtering: Block the identified dead-drop URL (telegra[.]ph) and review proxy logs for traffic to the IP reputation services abused for anti-analysis (ipleak.net, geojs.io, ipapi.co, ipapi.is, ipinfo.io) if those are not standard business tools.

5. Indicators of compromise

sha256  bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c
sha256  e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9
sha256  a4f03272cf96732dc9f58bb466d16f358e7f50d46dba30526a9fbebfec11717b
sha256  bf04160dd1ce3571e0eb6d6dda1713c788797b5599399d4a93665a757eec376e
sha256  54fa8083c05334aa360256fbbb0ca901ce7e244a0359dd664cae78977371ec91
sha256  c1ea6d169565c70ac5d812e73483814929e9b3548ead6633595937e71a334adb
sha256  001337488c32d8610c2aef6f9330acca825f0afacd071bf6ebfc06b5a1a69f09
sha256  2837099af431e9afee76ce5e6ab5cb86bedce06e31c22be46250cb453cfdb978
sha256  252c5a3d150275013f52b4820097d7163ced4aa2f1be0fca032f8a5017673816
sha256  0c9c64b7383ec249bcf6271a4b73206d94de130ca401d16ab77fe01e5193a312
sha256  6700f62e1a3b33340cd678c388ecc8bac2e5943c0627df5d1b99b879c3ca42c9
ipv4  93.152.224[.]75
ipv4  65.21.80[.]170
ipv4  195.63.142[.]49
domain  perfectverified[.]com
domain  catalyst-pro[.]lat
domain  twigoamwu[.]cfd
domain  trusaifi[.]cfd
domain  stellar-minds[.]cfd
domain  pinnacle-labs[.]lat
domain  nexahub[.]lat
domain  fimwoglea[.]shop
domain  velodium[.]lat
domain  rpcsecnoweb[.]pro
domain  more-arpc[.]icu
domain  echo-systems[.]cfd
domain  kelemet[.]shop
domain  zarwieciv[.]cfd
url  hxxps://telegra[.]ph/Project-PySynth-06-28

6. Detection

rule PavinLoader_Artifacts {
    meta:
        author = "Adverse Trace"
        date = "2026-08-24"
        reference = "https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns"
        description = "Detects PavinLoader builder artifacts and distinctive strings"
    strings:
        $builder1 = "EDIT HERE" nocase
        $builder2 = "REPLACE with a real direct link to your .bat" nocase
        $builder3 = "Automated builder helper" nocase
        $pe_loader1 = "GollopMailers LDR DllBase VeneryCondole EdiyaFoully=0x{0:X} EdiyaStelae=0x{1:X}" nocase
        $pe_loader2 = "GollopMailers LDR Flags missing IMAGE_DLL 0x{0:X8}" nocase
        $pe_loader3 = "GollopMailers LDR SaranPisco invalid 0x{0:X}" nocase
        $pe_loader4 = "GollopMailers LDR TlsIndex invalid {0}" nocase
        $pe_loader5 = "GollopMailers LDR sanity exception: " nocase
        $pe_loader6 = "LdrpHandleTlsData outside ntdll .text" nocase
        $pe_loader7 = "LdrpReleaseTlsEntry outside ntdll .text" nocase
        $pe_loader8 = "Required API resolve failed: type={0}, FreshBubals={1}, module=0x{2:X}" nocase
        $fake_comment = "BUILD VERIFICATION REPORT" nocase
    condition:
        3 of them
}

title: PavinLoader MSBuild Execution from AppData
id: 7a9c2e1f-8b4d-4e3a-9f5c-1d2e3f4a5b6c
status: experimental
description: Detects MSBuild or conhost executing from AppData paths, consistent with PavinLoader infection chains
author: Adverse Trace
date: 2026/08/24
references:

    - https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns
logsource:
    product: windows
    category: process_creation
detection:
    selection_msbuild:
        Image|endswith:

            - '\MSBuild.exe'
            - '\prefetch_*.exe'
        CommandLine|contains:

            - '\AppData\Local\'
            - '.csproj'
            - '/nologo'
    selection_conhost:
        Image|endswith: '\conhost.exe'
        CommandLine|contains|all:

            - '--headless'
            - 'cmd.exe /c'
            - '\AppData\Local\'
    selection_env_var:
        CommandLine|contains: 'MSBUILDENABLEALLPROPERTYFUNCTIONS=1'
    condition: selection_msbuild or selection_conhost or selection_env_var
fields:

    - Image
    - CommandLine
    - ParentImage
falsepositives:

    - Legitimate software development builds executed from user profiles (rare in enterprise environments)
level: high

7. Sources

• Malwarebytes — Tracking PavinLoader across ClickFix and fake download campaigns — https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns — 2026-08-24
• Malwarebytes Labs — Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding — https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-games-spread-stealers-with-renpy-loader-msbuild-and-etherhiding — 2026-07

8. Adverse Trace position

PavinLoader represents a maturing, multi-vector loader threat with credible indicators of a Loader-as-a-Service model, increasing the likelihood of widespread deployment against EMEA financial sector employees via social engineering. The use of EtherHiding for C2 resolution significantly complicates infrastructure takedown, and the delivery of Amatera Stealer poses a direct risk to session tokens and credentials. As this analysis is currently single-sourced from Malwarebytes, we are treating the LaaS attribution as unconfirmed. We will continue to track PavinLoader artifacts across additional telemetry feeds and will update clients if independent confirmation of the LaaS model or new campaign clusters emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.