Grab-and-go Baldr malware enters the black market

[Mohammad.Poorya]

A new form of information-stealing malware called Baldr believed to be the work of experienced hackers is making the rounds in Russian underground forums.

On Tuesday, researchers William Tsing, Vasilios Hioureas, and Jérôme Segura from Malwarebytes

Zaloguj lub Zarejestruj się aby zobaczyć!

on the new malware strain, found to be newly-introduced to interested cybercriminals.

Information stealers such as Baldr have proven popular in rapid-fire attacks and phishing, given their ability to capture information including machine data, browser history, some stored passwords -- depending on how and where they are buried -- and valuable files.

Baldr is no different. The malware has "high-level functionality" and the team says is by no means a script kiddie effort thrown together for quick cash.
Instead, Baldr is able to gather user profile data including browser information, as well as detecting the existence of cryptocurrency wallets, VPNs, Telegram, and Jabber. The malware then cycles through the files and folders of key PC locations in order to extract information from important file types.

The data theft then begins, shotgun-style, with .DOC, .DOCX, .LOG and .TXT files of particular interest to the malware's operators. Baldr is able to grab an entire file's contents for transfer to its command-and-control (C2) server.

Zaloguj lub Zarejestruj się aby zobaczyć!