Tracking PavinLoader across ClickFix and fake download campaigns

This report analyzes PavinLoader, a heavily obfuscated multi-stage .NET loader observed across several campaigns (RenPy, ClickFix, fake software downloads) that uses EtherHiding (blockchain-based C2 discovery), MSBuild/.csproj/.bat abuse, and trojanized .NET DLLs to deliver payloads including Amatera Stealer; the analysis details distribution methods, stage functionality (loader, EtherHiding loader, anti-analysis DLL, PE loader), anti-analysis and obfuscation techniques, and provides IOCs (SHA-256 hashes, IPs, domains, and URLs).