Loading malware…
PavinLoader is a multi-stage .NET malware loader targeting Windows systems. It has been observed in ClickFix campaigns using fraudulent verification or CAPTCHA-style prompts, as well as fake software-download and malicious RenPy game-installer campaigns. Execution chains commonly abuse legitimate Windows development tooling, including MSBuild and project files, alongside trojanized and obfuscated .NET libraries to reconstruct and execute staged components.
PavinLoader uses separate loader, command-and-control discovery, anti-analysis, and PE-loading stages. It employs EtherHiding to obtain command-and-control infrastructure through blockchain-based smart-contract queries rather than embedding infrastructure directly. Its anti-analysis functionality performs virtualization, sandbox, hosting-provider, geolocation, and regional-language checks; other observed evasion includes encrypted strings, API hashing, timing checks, and modifications that weaken certificate validation and alter proxy settings.
The loader retrieves and executes follow-on payloads after host screening. Observed payloads include Amatera Stealer and HijackLoader, enabling credential, browser-data, cryptocurrency-wallet-data, and file theft through deployed secondary malware. Reuse across multiple campaign clusters and builder-like artifacts suggest a possible loader-as-a-service model, but a commercial operation and associated threat actor have not been confirmed.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Other samples used BAT or CMD files with harmless-looking comments... They relaunch through conhost.exe, locate MSBuild, and reconstruct a loader from encoded data.
The project file used MSBuild to load the altered library, hiding malicious work in a component used to build software.
They relaunch through conhost.exe, locate MSBuild, and reconstruct a loader from encoded data.
Resolves APIs using API hashing and GetDelegateForFunctionPointer()
Its contents included a renamed legitimate MSBuild executable... In the documented RenPy chain, the final file posed as WPA.exe, the name of Windows Performance Analyzer.
The project file used MSBuild to load the altered library, hiding malicious work in a component used to build software.
The Loader DLL is reconstructed by concatenating and decoding four Base64-encoded variables.
PavinLoader uses legitimate Windows tools alongside malicious .NET files to run several stages of malware.
Before delivering the final payload, an anti-analysis module checks for virtual machines, hosted infrastructure, and systems using language or regional settings.
It also performs extensive system reconnaissance, including enumerating registry keys and calling Win32 APIs such as GetSystemFirmwareTable() and EnumSystemFirmwareTables() to identify virtualized environments.
More than 100 URLs belonging to legitimate services are also decrypted and used to generate HTTP requests and network noise.
The second component uses EtherHiding to identify its command-and-control server. Rather than storing the destination in the malware, it makes a blockchain request and retrieves the address from a smart-contract response.
EtherHiding to obtain the C2 domain, followed by HTTP requests using paths such as assets/{two random words}.json to retrieve subsequent stages.
Changes network settings, including disabling TLS certificate validation and setting the default system proxy
It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware.
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as an example of an earlier ClickFix campaign; it is not part of the SloppyRAT infection chain described.
A loader mentioned only as an example of an earlier ClickFix campaign, not as part of the SloppyRAT campaign described.
Loader used in ClickFix, fake software download, and malicious game installer campaigns. It abuses trusted Windows components and staged .NET libraries, performs anti-analysis checks, can alter network settings and disable certificate validation, uses EtherHiding/blockchain lookups to resolve C2 infrastructure, and then downloads additional payloads.
A multi-stage .NET loader used across malicious RenPy, ClickFix, and fake software download campaigns. It abuses trojanized .NET DLLs, MSBuild, .csproj and .bat files, uses EtherHiding to retrieve C2 infrastructure from blockchain data, performs anti-forensics and anti-analysis steps, and delivers follow-on payloads including stealers and other malware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.