Meet Baldr: The Inside Scoop on a New Stealer

Baldr first appeared in January and has since evolved to version 2.2 as attackers aim to build a long-lasting threat.

Baldr is a fairly new stealer on the threat landscape, though researchers say its rapid development signifies authors are preparing to cultivate a long-term problem.
The team at Malwarebytes Labs has been monitoring the heightened growth and development of stealers for the past few months; it reports Baldr first appeared in January. Analysis indicates Baldrs developers are investing time and effort into their product, which, like many stealers, is becoming more popular as cybercriminals hunt for easy means to snag valuable data.
Stealers are sneaky, and victims rarely know theyre hit unless its detected at delivery. Upon infection, stealers typically scan the target machine and grab what they need – browser history, screenshots, passwords, cookies – in as little as a minute, explains Malwarebytes threat intelligence lead Jerome Segura. They may also seek out files containing sensitive information.
Unlike banking Trojans, stealers are nonresident, he continues. Theyre not going to stay on the computer for long periods of time, Segura says. Once the stealer has what its author is looking for, it zips the files, uploads them to the attackers server, and vanishes. Victims who scan for a stealer after its disappearance will likely never know it was there, he points out.
Not A Script Kiddies Work
Baldr is likely the product of three threat actors: Agressor for distribution, Overdot for sales and promotion, and LordOdin for development. Overdot, which was previously linked to the Arkei stealer, markets Baldr on message boards, helps customers via Jabber, and addresses complaints in boards reputational systems. Baldr has proved popular on Russian hacking forums, researchers
point out
, and has a reputation for decent communication with authors.
Since it was first detected, Baldr has evolved from version 1 to version 2.2, the latest edition analyzed by the Malwarebytes team. Researchers collected a few different versions of Baldr, which has short development cycles and was most recently updated on March 20.
Baldrs main functionality can be described in five steps: It first collects a list of user profile data, from the user account name to OS type. After that, it goes through files and folders in key locations on the machine, keeping an eye out for sensitive info. Baldr then conducts ShotGun file grabbing, grabbing the contents of .doc, .docx, .log, and .txt files it finds. The last step in data collection is to grab a screenshot of the users computer. Finally, it exfiltrates the package.
While theres nothing especially groundbreaking about how Baldr works on target machines, its worth noting the developers seem invested in crafting this threat for long-term success. It is not the work of a script kiddie, as researchers warn in a blog post on their analysis.
When it was first rolled out, Baldr had what youd expect in terms of capabilities, Segura says. As its customer base grew, authors introduced bug fixes and improved the back end. Baldr sold for $100, which included the stealer along with a control panel to track the number of victims, download stolen data, and view stats like victims location and operating systems they used. He anticipates Baldrs authors will continue to add new features and bug fixes in future versions.
Stealer Upgrade: Targeting YouTube, Bitcoin
Attackers have several means of targeting victims with Baldr; one of the primary vectors is the use of malicious applications masked as hacking tools. Researchers found YouTube videos offering fake programs to create free Bitcoin, which turned out to be Baldr stealers in disguise.
There is no such thing as free Bitcoin, but some people will still look for them, Segura says. Plenty of YouTube videos promise get-rich-quick hacks accompanied with a malicious link. People will download and try to do what they do in the video, but in actuality theyre going to infect themselves, he adds.
While stealers arent a new threat, old ones were more focused on passwords and browser histories. New stealers are beginning to focus on cryptocurrency wallets and their passwords, and to seek them out when scanning target machines. Segura speculates there could potentially be a link between the YouTube videos promising free Bitcoin and the targeting of cryptocurrency wallets once Baldr lands on a victims machine.
Related Content:
Craigslist Founder Funds Security Toolkit for Journalists, Elections
Digital Doppelganger Underground Takes Payment Card Theft to the Next Level
Exodus iOS Surveillance Software Masqueraded as Legit Apps
Credential-Stuffing Attacks Behind 30 Billion Login Attempts in 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Meet Baldr: The Inside Scoop on a New Stealer