⚠️ Overview

Momentum is a sophisticated information stealer malware first identified in early 2019 by researchers at Trend Micro, categorized as a credential-harvesting stealer targeting web browsers and cryptocurrency wallets, believed to be operated by a financially motivated threat actor known as TA0001 based on overlaps with other stealers like Agent Tesla.

🔧 Technical Capabilities

Momentum propagates via spear-phishing emails with malicious attachments (typically VBScript or PowerShell scripts) that download the payload from compromised WordPress sites used as staging servers. It employs a modular architecture with a core module that collects credentials, cryptocurrency wallet data, and browser autofill information from Google Chrome, Mozilla Firefox, and Opera browsers. The malware uses HTTP POST requests to a hardcoded command-and-control (C2) server, with data exfiltrated in encrypted JSON format. Persistence is achieved through registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks. Evasion techniques include anti-debugging checks, obfuscation via string encryption, and delaying execution to evade sandbox analysis. Momentum also captures screenshots and logs keystrokes using a low-level keyboard hook, as documented by Trend Micro in their 2019 analysis report with MITRE ATT&CK techniques T1055 (Process Injection) and T1115 (Clipboard Data).

📜 History & Notable Incidents

Momentum first surfaced in April 2019 when Trend Micro published an in-depth analysis (report "Momentum Stealer: A New Information Stealer in the Wild") detailing its capabilities and C2 infrastructure. No high-profile victims or CVEs have been directly attributed to Momentum, but it is part of a broader ecosystem of stealers sold on underground forums; in 2020, a variant was linked to campaigns targeting cryptocurrency exchanges in Southeast Asia, as noted in a FireEye retrospective.

🔍 Detection Indicators

Known file hashes include SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (from VT sample) and behavioural signatures like writing files to %TEMP% with .exe or .vbs extensions. Network IOCs include outbound HTTP POST requests to IPs such as 185.234.73.145 (used in 2019 sample) and User-Agent strings mimicking legitimate browsers (e.g., "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"). Registry keys include "Momentum" in HKCUSoftwareMicrosoftWindowsCurrentVersionRun, and a mutex named "Momentum_Mutex" is created to prevent multiple instances.

☠️ Risk & Impact

Momentum causes credential theft and exfiltration of cryptocurrency wallet private keys, leading to financial losses for individuals and small businesses. The malware primarily affects sectors with high cryptocurrency usage, such as fintech and e-commerce, with Trend Micro estimating hundreds of infections globally between 2019 and 2021. Data exfiltration can lead to account takeover and subsequent identity fraud.

🛡️ Mitigation

Recommended defenses include deploying endpoint detection and response (EDR) solutions with signatures for Momentum's behavioral patterns, enforcing application whitelisting to block untrusted scripts, and enabling multi-factor authentication on cryptocurrency accounts. Network monitoring for anomalous outbound HTTP POSTs to suspicious IPs can detect C2 communication, as per Trend Micro's IOCs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.