Analysis of PavokwiLoader and RMMCRAT Malware Campaign

A sophisticated multi-stage intrusion campaign has been identified, primarily using SEO poisoning to deliver a suite of custom malware. The attack chain involves PavokwiLoader, a C++ loader with over 80,000 instructions and heavy Mixed Boolean-Arithmetic (MBA) obfuscation, and RMMCRAT, a custom C++ remote access tool masquerading as legitimate management software. These tools are designed to evade analysis through hardware breakpoint detection, GPU-based VM checks, and unique entropy-based payload extraction methods.

The technical analysis reveals a high degree of tradecraft, including the use of hardware breakpoints to bypass Event Tracing for Windows (ETW), reflective PE loading in Python, and UAC bypass via the APPINFO RPC interface. The campaign culminates in the deployment of Cobalt Strike beacons (watermark 987654321) and specialized Hidden Virtual Network Computing (HVNC) modules for stealthy remote control and browser profile theft.

This threat is particularly significant due to its emphasis on surviving analyst scrutiny and sandbox automation. The use of custom RMM tools and legitimate-sounding software (e.g., JivaChat) suggests a focus on establishing long-term persistence within targeted environments while evading standard EDR detections that rely on common API hooks.