Cybersecurity researchers have uncovered wider use of PavinLoader, a multi-stage malware loader linked to ClickFix lures, fake software installers, and malicious RenPy game campaigns.
The loader combines legitimate Windows tools, trojanized .NET libraries, heavily obfuscated code, and blockchain-based infrastructure hiding to deliver final payloads.
PavinLoader was previously observed in attacks distributing Amatera Stealer, an information-stealing malware family.
Researchers have now found the same loader framework in several unrelated campaign clusters, suggesting that it may be offered to other criminals as a Loader-as-a-Service, although no public sales panel or marketplace has been identified.
Victims may initially encounter a fake CAPTCHA page, a bogus Cloudflare or Google verification prompt, a pirated software download, or a malicious game installer.
These lures use social engineering to persuade users to execute commands or install files that appear legitimate.
PavinLoader Abuses MSBuild DLLs
Once launched, PavinLoader uses Windows build tools to execute malicious code. Attackers commonly bundle legitimate MSBuild executables with .csproj, .bat, .cmd, or MSI files.
The project files use MSBuild features such as UsingTask and assembly-loading functions to run malicious .NET DLLs.
Many of these DLLs are modified copies of legitimate open-source libraries, including DotNetZip, Nancy, Renci.SshNet, and OpenXML.
The malicious code is inserted into methods with random-looking names, such as DefaultEvaluator5 or FallbackFactory5, making the altered libraries harder to identify during quick inspection.
The malware also uses filename patterns designed to blend into normal software activity. Examples include prefetch_2f76.exe, telemetry_55db.cmd, and bootstrap_64be.cmd.
Some installers use folders named after legitimate hardware or software vendors to appear trustworthy.
PavinLoader’s batch files may include fake comments such as “BUILD VERIFICATION REPORT” or “Automated builder helper.”
Below these comments, attackers hide obfuscated commands that rebuild strings, decode Base64 data, locate MSBuild, and launch the next stage.
A key part of PavinLoader is its use of EtherHiding. Instead of embedding a command-and-control domain directly in the malware, the loader queries blockchain infrastructure to retrieve it.
This makes takedowns and detection more difficult because the malicious server location can be changed without updating the original malware sample.
The loader then downloads additional encrypted stages from paths resembling assets/{random words}.json. Researchers observed C2 domains using top-level domains including .lat, .cfd, .shop, and .icu.
The infection chain typically contains four stages: an initial loader DLL, an EtherHiding component, an anti-analysis DLL, and a PE loader that runs the final payload.
The anti-analysis stage checks for virtual machines, sandbox tools, debugging environments, system language settings, and hosting-provider IP addresses, malwarebytes said.
Indicators of Compromise
| IOC Type | Indicator | Description |
|---|---|---|
| SHA-256 | bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c | PavinLoader-related sample |
| SHA-256 | e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9 | PavinLoader-related samp |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
