Threat Actor Characterization
MawaStealer
ID: 22d4239b525d46f1005c19a79ec5c21115891Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
|
a5f09faf59527c9f13c715253f52dc7141500 | Vidar Stealer | Unknown | related | Crimeware |
Related files
| Filename | Size | SHA-1 | OS target | Identified |
|---|---|---|---|---|
| MawaStealer_v2_Vidar_Stealer.bin | 635.5 KB | af3d6681************************d23130b7 | Malware | |
| payload_decrypted.bin | 409.56 KB | 26cde3ac************************b204bc50 | Malware | |
| schema_abso.dll | 880.5 KB | 86b28f2d************************696749e4 | Malware |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
MawaStealer is an infostealer campaign distributed via piracy/torrent lures. Public analysis describes a staged chain (LNK→batch→PowerShell→.NET) collecting Chrome profile data, selected crypto wallet artifacts, and Telegram credentials, with HTTPS exfiltration to installinfo[.]dynu[.]net. A later wave (INFERENCE: same operator) uses signed-binary DLL sideloading via VLC (malicious libvlc.dll) and delivers Vidar Stealer v2, exfiltrating to tester[.]technologytorg[.]com.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1204 | User Execution | TA0002 |
|
| T1059.001 | PowerShell | TA0002 |
|
| T1059.003 | Windows Command Shell | TA0002 |
|
| T1053.005 | Scheduled Task | TA0002 TA0003 TA0004 |
|
| T1574.001 | DLL | TA0003 TA0004 TA0005 |
|
| T1027 | Obfuscated Files or Information | TA0005 |
|
| T1071.001 | Web Protocols | TA0011 |
MawaStealer — Torrent-lure infostealer with staged loader chain; later evolution to DLL sideloading (INFERENCE)
Classification: TLP:WHITE – Open Source Intelligence (OSINT)
Category: Malware / Infostealer — Origin: Unknown
Author: iQBlack CTI Team
Executive Summary
MawaStealer is described in public malware analysis as an information-stealing campaign primarily distributed to end users through piracy/torrent-themed lures. The initial publicly documented wave (Sep 2025) used a multi-stage chain involving a malicious shortcut (.lnk) that launched a batch dropper, PowerShell stages, and multiple .NET payload layers (including ConfuserEx-packed components). The reported collection focus included Chrome profile data (passwords/sessions/extensions), select cryptocurrency wallet artifacts, and Telegram credentials, plus basic host profiling checks (e.g., AV enumeration, webcam presence) and simple anti-debug logic.
Public reverse engineering identifies an exfiltration endpoint at installinfo[.]dynu[.]net and victim-side artifacts such as a service name (ServiceMcCSPStartupv2) and dropped directories/files under Public/ProgramData paths. In late Feb 2026, a separate analysis describes what appears to be a second wave using a more sophisticated delivery mechanism: a legitimate signed VLC executable that sideloads a malicious libvlc.dll, followed by a multi-stage unpacking chain and eventual delivery of a Vidar Stealer v2 payload.