Last seven days
- First activity
- Aug 24, 2026
- Last activity
- Aug 24, 2026
- Feed role
- C2
- Host form
- 0 IP / 14 hostnames
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
11 Aug 24
Observed infrastructure
Leading locations
- US11
Leading providers
- Cloudflare, Inc.11
Infrastructure traits
- Anycast 11
- Hosting 11
- Proxy 1
MITRE ATT&CK
PavinLoader in ATT&CK
27 distinct techniquesTechniques
27 techniques T1105 Ingress Tool Transfer T1497.001 System Checks T1562.001 Disable or Modify Tools T1614 System Location Discovery T1204.002 Malicious File T1620 Reflective Code Loading T1059.003 Windows Command Shell T1027.007 Dynamic API Resolution T1027 Obfuscated Files or Information T1218 System Binary Proxy Execution T1140 Deobfuscate/Decode Files or Information T1564.001 Hidden Files and Directories T1059.001 PowerShell T1082 System Information Discovery T1497 Virtualization/Sandbox Evasion T1071 Application Layer Protocol T1070.004 File Deletion T1204 User Execution T1071.001 Web Protocols T1102.001 Dead Drop Resolver T1008 Fallback Channels T1127.001 MSBuild T1572 Protocol Tunneling T1036 Masquerading T1090.001 Internal Proxy T1112 Modify Registry T1665 Hide Infrastructure
Reporting
Research mentioning PavinLoader
Aug 24
Malware News
Tracking PavinLoader across ClickFix and fake download campaigns - Malware News - Malware Analysis, News and Indicators
Researchers linked PavinLoader, a multi-stage .NET malware loader, to several intrusion chains that used ClickFix lures, fake software downloads, and malicious RenPy packages to infect victims. Across the campaigns, operators relied on trojanized and heavily obfuscated .NET DLLs, along with abuse of MSBuild through .csproj and .bat files, to execute later stages while complicating analysis and detection. The loader retrieved command-and-control details using EtherHiding, including Binance Smart Chain RPC calls to pull infrastructure data from blockchain-hosted content, and then fetched additional payloads. In observed cases, PavinLoader delivered Amatera Stealer and at times HijackLoader, while also using anti-analysis and anti-forensics measures such as AMSI/ETW-related evasion strings, virtualization checks, locale filtering, and infrastructure-provider checks; shared artifacts and builder-like scripts led researchers to assess that it may be operated as a Loader-as-a-Service, though no commercial panel or offering was confirmed.
Aug 24
Malwarebytes Labs
