PavinLoader Uses ClickFix and Fake Downloads to Deploy Amatera Stealer via Blockchain C2

PavinLoader, a multi-stage .NET malware loader, operating across ClickFix, fake software-download, and malicious game campaigns.

The activity shows how attackers are moving beyond a single delivery vector. A victim may be lured to a fake Cloudflare or Google verification page and instructed to paste a command, persuaded to install apparently legitimate software, or tricked into downloading a game or mod.

Once execution begins, however, the subsequent chain follows a consistent blueprint built to frustrate static detection, sandbox analysis, and infrastructure takedowns.

PavinLoader commonly arrives in Inno Setup or MSI packages that masquerade as routine installers.

These packages include BAT or CMD launchers, .csproj project files, a renamed legitimate MSBuild.exe, and trojanized .NET DLLs.

The malware abuses MSBuild’s UsingTask functionality and .NET assembly-loading features to execute malicious code while blending into a legitimate developer-tool workflow.

Researchers observed tampered versions of libraries including DotNetZip, Nancy, Renci.SshNet, and OpenXML.

The injected methods often use a two-word or two-word-plus-number naming convention, such as DefaultEvaluator5 or FallbackFactory5.

Similar randomly paired words appear throughout the operation in DLL names, functions, strings, and C2 request paths, creating a recognizable cluster-level fingerprint.

In one ClickFix example, a fake Cloudflare lure distributed an MSI package containing a legitimate MSBuild binary, a .csproj file, and a malicious DotNetZip DLL.

Another sample used an MSI custom action to launch an obfuscated CMD file decorated with fake “BUILD VERIFICATION REPORT” comments.

The script then relaunches through conhost.exe, enables MSBUILDENABLEALLPROPERTYFUNCTIONS, and invokes MSBuild to run the next stage.

Malwarebytes said in a report shared with GBhackers, the loader combines trusted Windows utilities, trojanized libraries, layered obfuscation, and EtherHiding a blockchain-backed technique for resolving command-and-control infrastructure to deliver Amatera Stealer.

PavinLoader Uses ClickFix

A core differentiator is PavinLoader’s use of EtherHiding. Rather than embedding a C2 domain directly in the loader, the malware queries a blockchain RPC service to obtain dynamically controlled infrastructure.

Malwarebytes observed an Ethereum JSON-RPC eth_call request to Binance’s BSC endpoint, with the returned smart-contract data supplying the C2 information used to fetch encrypted payloads.

That design gives operators operational resilience. Defenders can block an identified download domain, but the loader can retrieve an updated destination address from the smart contract without requiring attackers to rebuild or redistribute the initial payload.

EtherHiding is specifically designed to conceal infrastructure data such as C2 addresses in blockchain-linked content, making attribution and disruption more difficult.

PavinLoader then requests subsequent components through paths resembling assets/{TwoRandomWords}.json. Observed C2 domains frequently used .lat, .icu, .shop, and .cfd top-level domains, while payload data was XOR-encoded within JSON responses.

The loader chain includes a first-stage DLL, an EtherHiding downloader, an anti-analysis DLL, and a PE loader.

The initial component turns off TLS certificate validation, changes proxy settings, performs timing checks, resolves APIs through hashing, and conducts anti-forensics operations.

Its anti-analysis stage looks for virtual-machine artifacts through registry inspection, firmware-table checks, PCI identifiers, BIOS strings, and system metadata.

It also checks keyboard layouts and queries public IP and geolocation services, apparently avoiding execution in certain regions and hosting-provider environments associated with research infrastructure.

When these checks pass, PavinLoader retrieves the final PE payload. In the previously documented RenPy campaign, the chain culminated in Amatera Stealer.

A C++ information stealer capable of anti-sandbox checks, browser enumeration, and theft of cryptocurrency wallet data and potentially credentials.malpedia.caad.fkie.

The reuse of the same loader architecture across unrelated-looking lures raises the possibility that PavinLoader may be operated as a Loader-as-a-Service.

Malwarebytes found a shared VirusTotal artifact across more than 200 related files and builder-like PowerShell and BAT content containing phrases such as “EDIT HERE,” “REPLACE with a real direct link,” and “Automated builder helper.”

However, researchers have not identified a sales portal or operator channel that confirms commercial availability.

For defenders, the campaign reinforces the need to monitor unexpected MSBuild execution, suspicious .csproj files in user-writable directories, renamed Windows binaries, and outbound blockchain RPC requests from endpoints.

Fake CAPTCHA instructions that require users to paste commands into Run dialogs, PowerShell, or terminals should be treated as a high-confidence social-engineering warning sign.

IOCs

Type	Indicator	Description
SHA-256	bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c	PavinLoader-related file hash
SHA-256	e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9	PavinLoader-related file hash
SHA-256	a4f03272cf96732dc9f58bb466d16f358e7f50d46dba30526a9fbebfec11717b	PavinLoader-related file hash
IP address	93.152.224[.]75	Downloads PavinLoader
IP address	65.21.80[.]170	Downloads PavinLoader
IP address	195.63.142[.]49	Downloads PavinLoader

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide