PavinLoader Spreads Through ClickFix and Fake Download Lures

Summary

PavinLoader is a multi-stage .NET loader observed across several campaigns, including ClickFix and fake software download operations. It relies on heavily obfuscated DLLs, abuse of MSBuild, and EtherHiding through blockchain infrastructure to retrieve command-and-control details. Its primary purpose is to deliver secondary payloads such as Amatera Stealer.

Investigation

The investigation identified a consistent infection chain built around trojanized .NET DLLs and abuse of legitimate Windows utilities such as MSBuild. Researchers documented how PavinLoader uses blockchain-based EtherHiding to evade traditional network detection. Analysis of the various stages also revealed advanced anti-analysis, anti-forensics, and custom obfuscation techniques.

Mitigation

Organizations should monitor for suspicious MSBuild activity and execution of unusual .csproj or .bat files. Strict application control can help prevent unauthorized DLL loading, while network monitoring should detect unexpected connections to blockchain RPC endpoints. Blocking known malicious TLDs such as .lat, .icu, and .shop may also reduce exposure.

Response

If PavinLoader activity is detected, affected hosts should be isolated immediately to prevent lateral movement or data exfiltration by Amatera Stealer. Responders should perform memory forensics to identify injected .NET code and review system proxy settings for unauthorized changes. Network logs should also be examined for connections to known C2 domains and blockchain-related RPC activity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to deploy PavinLoader using a “ClickFix” social engineering tactic. To evade detection, they download a malicious payload disguised as a driver update. They place a batch script in a fake Conexant directory within AppData. They then use MSBuild.exe to execute this batch script, leveraging the legitimate Microsoft compiler to run their obfuscated command, thereby bypassing simple execution restrictions and blending into system noise.

• Regression Test Script:

  # PavinLoader Simulation Script
  $userProfile = $env:USERPROFILE
  $targetDir = "$userProfileAppDataLocalConexantlite_bootstrap_2.1.7"
  $batFile = "$targetDirupdater_8219.cmd"
  
  # 1. Create the masqueraded directory structure
  New-Item -Path $targetDir -ItemType Directory -Force
  
  # 2. Create the malicious batch file (simulating obfuscated logic)
  "@echo off`ncall $batFile /launched" | Out-File -FilePath $batFile -Encoding ascii
  
  # 3. Trigger Indicator 3: MSBuild executing the batch file
  Write-Host "[+] Simulating Indicator 3: MSBuild execution..."
  Start-Process "C:WindowsMicrosoft.NETFramework64v4.0.30319MSBuild.exe" -ArgumentList "`"$batFile`"" -Wait
  
  # 4. Trigger Indicator 4: Headless conhost execution
  Write-Host "[+] Simulating Indicator 4: Headless conhost execution..."
  Start-Process "C:WindowsSystem32conhost.exe" -ArgumentList "--headless cmd.exe /c `"$batFile`" /launched"

• Cleanup Commands:

  # Cleanup Simulation Artifacts
  $userProfile = $env:USERPROFILE
  $pathsToCleanup = @(
      "$userProfileAppDataLocalLogitech",
      "$userProfileAppDataLocalConexant"
  )
  
  foreach ($path in $pathsToCleanup) {
      if (Test-Path $path) {
          Remove-Item -Path $path -Recurse -Force
          Write-Host "[+] Removed $path"
      }
  }