Tracking PavinLoader across ClickFix and fake download campaigns

In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain.

Further threat hunting has since shown that the same loader, which we track as PavinLoader , is being used across several different campaigns, including ClickFix attacks and fake software downloads.

Despite differences in how these campaigns reach victims, we found several common elements. These include multi-stage infection chains involving heavily obfuscated and trojanized . NET DLLs; abuse of MSBuild, . csproj , and . bat files to execute them; and EtherHiding to retrieve the command-and-control (C2) domain.

What an attack looks like

The campaigns don’t all start the same way. A victim might encounter a fake CAPTCHA that tells them to run a command, download what appears to be legitimate software, or install a malicious game.

What happens next is much more consistent. PavinLoader uses legitimate Windows tools alongside malicious . NET files to run several stages of malware. It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware.

In the RenPy campaign we analyzed, that process ultimately led to Amatera Stealer , malware designed to steal information from an infected computer. We also observed PavinLoader infections delivering additional malware.

PavinLoader appears across multiple campaigns

We have identified PavinLoader in several campaign clusters:

• Malicious RenPy campaigns, as analyzed in our earlier blog post
• Several ClickFix campaigns, including recent activity from the operator(s) covered in our previous analysis
• Fake software campaigns that used Dropbox to download PavinLoader.

The loader’s use across multiple campaigns raises the possibility that PavinLoader is offered as a Loader-as-a-Service.

In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain.

Further threat hunting has since shown that the same loader, which we track as PavinLoader , is being used across several different campaigns, including ClickFix attacks and fake software downloads.

Despite differences in how these campaigns reach victims, we found several common elements. These include multi-stage infection chains involving heavily obfuscated and trojanized . NET DLLs; abuse of MSBuild, . csproj , and . bat files to execute them; and EtherHiding to retrieve the command-and-control (C2) domain.

What an attack looks like

The campaigns don’t all start the same way. A victim might encounter a fake CAPTCHA that tells them to run a command, download what appears to be legitimate software, or install a malicious game.

What happens next is much more consistent. PavinLoader uses legitimate Windows tools alongside malicious . NET files to run several stages of malware. It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware.

In the RenPy campaign we analyzed, that process ultimately led to Amatera Stealer , malware designed to steal information from an infected computer. We also observed PavinLoader infections delivering additional malware.