Grab-and-go Baldr malware enters the black market

guest · Apr 9, 2019

Grab-and-go Baldr malware enters the black market
Baldr has been linked to three prominent hackers in the Russian underground
April 9, 2019
https://www.zdnet.com/article/grab-and-go-info-stealer-baldr-malware-enters-the-black-market/

On Tuesday, researchers William Tsing, Vasilios Hioureas, and Jérôme Segura from Malwarebytes published a report on the new malware strain, found to be newly-introduced to interested cybercriminals.

The malware has "high-level functionality" and the team says is by no means a script kiddie effort thrown together for quick cash.
The malware then cycles through the files and folders of key PC locations in order to extract information from important file types.
Baldr is able to grab an entire file's contents for transfer to its command-and-control (C2) server.

According to the company, Baldr has been met "positively" since its launch in late 2018.
"[...] Baldr will have to compete against other stealers and differentiate itself. However, the demand for such products is high, so we can expect to see many distributors use it as part of several campaigns."
Click to expand...

guest · Aug 6, 2019

Baldr malware unpicked with a little help from crooks’ bad opsec
August 6, 2019
https://nakedsecurity.sophos.com/20...ked-with-a-little-help-from-crooks-bad-opsec/

The research in question concerns Baldr, an up-and-comer in the world of illegal software that SophosLabs’ has been tracking closely since January.

In simple terms, Baldr is a password stealer, although in reality it’s more of an indiscriminate malware thief with an interest in anything it can carry away. It would steal your watch if it could.
In the case of Baldr, the sleeve rolling started early. In an attempt to frustrate malware analysts, it hides its secrets under layers of obfuscation, so the SophosLabs boffins had to flay it by hand.

Baldr employs an excessive number obfuscation layers (at last count, 9) that thwarts static code analysis. Can we hack it? (Yes we can!)
If you’re unlucky enough to get it on your system, the malware will grab anything that looks like it might contain useful or valuable data.

Our knowledge of Baldr and its C2 infrastructure was assisted, unintentionally, by our story’s second bunch of humans: Baldr’s customers.
With a copy of the C2 code, the folks in the labs were able to learn more about the malware authors’ strategy and motivations
Click to expand...

Sophos: Baldr vs The World: A SophosLabs report (PDF - 7.60 MB): https://www.sophos.com/Baldr

guest · Aug 14, 2019

Fornite, Apex Legends cheaters have been targeted by 'hit and run' malware
Initial distribution of Baldr began early this year via cheats offered on YouTube
August 13, 2019
https://www.pcgamer.com/au/fornite-apex-legends-cheaters-have-been-targeted-by-hit-and-run-malware/

Sophos cyber research chief Chester Wisniewski described the malware as "hit and run," telling The Telegraph that once it fires up, "it instantly steals everything on the comp, bundles it up, and sends it to the crooks." He also offered a little insight into why Baldr gained its initial traction through online games.

"Teenagers are easily convinced to cheat with their friends and are much less likely to understand that these things might be malicious and cause problems on their computers than an adult might," he said. "They will click anything."
The origin of the malware isn't known, but the bulk of Baldr infections so far have been found in Indonesia (including Singapore), Brazil, and Russia; the US accounts for roughly 10.5 percent of infections. There's also an option to ensure that it doesn't attack targets within Russia, which could be telling: As The Telegraph noted, it's a criminal offense in Russia to hack domestic targets.

Sophos also told The Telegraph that Baldr's primary goal was likely to access gaming accounts in order to steal and sell in-game currency. But it has since seen "Netflix paswords, social media logins, and even airmiles accounts" being offered for sale on the dark web.
Click to expand...

Log in or Sign up

Grab-and-go Baldr malware enters the black market

guest Guest

guest Guest

guest Guest

Log in or Sign up

Grab-and-go Baldr malware enters the black market

guest Guest

guest Guest

guest Guest

Useful Searches