Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

4/9/2019
03:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Meet Baldr: The Inside Scoop on a New Stealer

Baldr first appeared in January and has since evolved to version 2.2 as attackers aim to build a long-lasting threat.

Baldr is a fairly new stealer on the threat landscape, though researchers say its rapid development signifies authors are preparing to cultivate a long-term problem.

The team at Malwarebytes Labs has been monitoring the heightened growth and development of stealers for the past few months; it reports Baldr first appeared in January. Analysis indicates Baldr's developers are investing time and effort into their product, which, like many stealers, is becoming more popular as cybercriminals hunt for easy means to snag valuable data.

Stealers are sneaky, and victims rarely know they're hit unless it's detected at delivery. Upon infection, stealers typically scan the target machine and grab what they need – browser history, screenshots, passwords, cookies – in as little as a minute, explains Malwarebytes threat intelligence lead Jerome Segura. They may also seek out files containing sensitive information.

Unlike banking Trojans, stealers are nonresident, he continues. "They're not going to stay on the computer for long periods of time," Segura says. Once the stealer has what its author is looking for, it zips the files, uploads them to the attacker's server, and vanishes. Victims who scan for a stealer after its disappearance will likely never know it was there, he points out. 

Not A Script Kiddie's Work
Baldr is likely the product of three threat actors: Agressor for distribution, Overdot for sales and promotion, and LordOdin for development. Overdot, which was previously linked to the Arkei stealer, markets Baldr on message boards, helps customers via Jabber, and addresses complaints in boards' reputational systems. Baldr has proved popular on Russian hacking forums, researchers point out, and has a reputation for decent communication with authors.

Since it was first detected, Baldr has evolved from version 1 to version 2.2, the latest edition analyzed by the Malwarebytes team. Researchers collected a few different versions of Baldr, which has short development cycles and was most recently updated on March 20.

Baldr's main functionality can be described in five steps: It first collects a list of user profile data, from the user account name to OS type. After that, it goes through files and folders in key locations on the machine, keeping an eye out for sensitive info. Baldr then conducts "ShotGun" file grabbing, grabbing the contents of .doc, .docx, .log, and .txt files it finds. The last step in data collection is to grab a screenshot of the user's computer. Finally, it exfiltrates the package.

While there's nothing especially groundbreaking about how Baldr works on target machines, it's worth noting the developers seem invested in crafting this threat for long-term success. "It is not the work of a script kiddie," as researchers warn in a blog post on their analysis.

When it was first rolled out, Baldr "had what you'd expect in terms of capabilities," Segura says. As its customer base grew, authors introduced bug fixes and improved the back end. Baldr sold for $100, which included the stealer along with a control panel to track the number of victims, download stolen data, and view stats like victims' location and operating systems they used. He anticipates Baldr's authors will continue to add new features and bug fixes in future versions.

Stealer Upgrade: Targeting YouTube, Bitcoin
Attackers have several means of targeting victims with Baldr; one of the primary vectors is the use of malicious applications masked as hacking tools. Researchers found YouTube videos offering fake programs to create free Bitcoin, which turned out to be Baldr stealers in disguise.

"There is no such thing as free Bitcoin, but some people will still look for them," Segura says. Plenty of YouTube videos promise get-rich-quick hacks accompanied with a malicious link. "People will download and try to do what they do in the video, but in actuality they're going to infect themselves," he adds. 

While stealers aren't a new threat, old ones were more focused on passwords and browser histories. New stealers are beginning to focus on cryptocurrency wallets and their passwords, and to seek them out when scanning target machines. Segura speculates there could potentially be a link between the YouTube videos promising free Bitcoin and the targeting of cryptocurrency wallets once Baldr lands on a victim's machine.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15150
PUBLISHED: 2019-08-19
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.
CVE-2017-18550
PUBLISHED: 2019-08-19
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.
CVE-2017-18551
PUBLISHED: 2019-08-19
An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.
CVE-2017-18552
PUBLISHED: 2019-08-19
An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.
CVE-2018-20976
PUBLISHED: 2019-08-19
An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.