Tracking PavinLoader across ClickFix and fake download campaigns

PavinLoader is a multi-stage .NET-based loader that operates through four main components: a Loader DLL performing anti-forensics, an EtherHiding Loader that retrieves C2 infrastructure via blockchain, an Anti-Analysis DLL that detects virtualized environments, and a PE Loader that delivers payloads such as Amatera Stealer. It abuses legitimate Windows tools like MSBuild for execution and employs custom obfuscation and API hashing to evade detection. The loader is distributed through multiple campaigns including ClickFix attacks, fake software downloads, and malicious RenPy games. Evidence suggests it is offered as a Loader-as-a-Service, indicated by common artifacts across a large number of related files. The malware uses sophisticated evasion techniques including anti-analysis, anti-forensics, and geographic targeting.

The malware enables attackers to deliver and execute payloads such as the Amatera Stealer, which can compromise sensitive information. Its advanced evasion techniques make detection and analysis difficult, increasing the risk of persistent infections. The use of blockchain-based C2 retrieval (EtherHiding) complicates takedown efforts and attribution. The loader's abuse of legitimate Windows tools and anti-analysis capabilities can hinder incident response and forensic investigations.

No official patch or remediation is indicated. Since this is malware distributed via multiple campaigns, mitigation should focus on detection and prevention through endpoint protection solutions capable of identifying obfuscated .NET loaders and suspicious use of MSBuild. Network monitoring for blockchain-based C2 communications and behavioral analysis to detect anti-forensics and anti-analysis techniques may help. Incident responders should be aware of the multi-stage infection chain and use specialized tools to analyze obfuscated DLLs. There is no vendor advisory indicating a fix; patch status is not yet confirmed — check vendor advisories for updates.