PavinLoader Malware Spreads via Fake Downloads and ClickFix Campaigns
Malwarebytes Labs is tracking PavinLoader, a sophisticated .NET loader used in multiple malicious campaigns, including fake software downloads and ClickFix attacks, often delivering information-stealing malware.
Malwarebytes Labs has identified a multi-stage .NET loader, which they are tracking as PavinLoader, being used across a variety of threat campaigns. These campaigns include deceptive fake software download schemes and the increasingly prevalent ClickFix attacks. While the initial infection vectors differ, the underlying PavinLoader infrastructure and techniques remain consistent, indicating a potentially modular and widely distributed malware operation.
The infection chains observed typically involve heavily obfuscated and trojanized .NET DLLs. Attackers leverage legitimate Windows tools and files, such as MSBuild and .bat scripts, to execute these malicious components in stages. A key technique employed by PavinLoader is EtherHiding, a method that utilizes blockchain technology to obscure the command-and-control (C2) infrastructure, making it harder for security researchers to track and disrupt the malware's communication.
Victims can encounter PavinLoader through various means. These include being tricked by fake CAPTCHA pages that prompt the execution of malicious commands, downloading what appears to be legitimate software from untrusted sources, or even installing seemingly harmless malicious games. Once initiated, PavinLoader orchestrates a series of actions, often culminating in the deployment of information stealers like Amatera Stealer, designed to exfiltrate sensitive data from compromised systems.
Malwarebytes has observed PavinLoader's presence in several distinct campaign clusters. These include malicious campaigns targeting users interested in RenPy, a game development engine, as well as multiple ClickFix campaigns. Furthermore, fake software download campaigns have been seen utilizing Dropbox to distribute the initial stages of PavinLoader. The widespread use across these diverse campaigns suggests a possible Loader-as-a-Service (LaaS) model, where the loader itself is offered to other threat actors.
Evidence supporting the LaaS hypothesis includes a shared artifact found in over 200 PavinLoader-associated files on VirusTotal, potentially indicating a common build process. Additionally, a PowerShell script discovered on VirusTotal contained comments like "EDIT HERE" and "REPLACE with a real direct link to your .bat," alongside a related .bat file with the string "Automated builder helper." While these point to a builder or helper tool, a confirmed sales channel or build panel has not yet been identified.
Common characteristics across the analyzed campaigns include the use of Inno Setup or MSI installers, trojanized .NET DLLs (such as DotNetZip, Nancy, Renci.SshNet, and OpenXML), and a common obfuscation technique applied to these DLLs. The malware often employs naming conventions based on random word pairs for various artifacts, including DLL names, functions, and C2 paths. EtherHiding is consistently used to obtain C2 domains, which frequently utilize TLDs like .lat, .icu, .shop, and .cfd, with subsequent stages downloaded via HTTP requests to paths like assets/{two random words}.json.
The PavinLoader architecture itself is modular, typically consisting of several .NET DLLs. These include a Loader DLL for initial execution and anti-analysis, an EtherHiding Loader DLL for C2 communication, an Anti-Analysis DLL to detect virtualized environments, and a PE Loader DLL to load the final payload. The specific intermediate payloads can vary depending on the campaign's configuration, highlighting the loader's flexibility in delivering different types of malware.
The distribution methods are varied, with ClickFix campaigns being a notable vector. Attackers often leverage MSBuild and .csproj files to execute malicious code. The initial MSI packages can contain legitimate executables like MSBuild alongside malicious .csproj files, which are then used to execute the trojanized .NET DLLs. This layered approach, combining legitimate tools with malicious code, makes detection and analysis more challenging for security defenses.