Chaes
MITRE ATT&CK: S0631 View on attack.mitre.org
Aliases: Chaes
- First seen
- 2020-01-01 00:00:00
- Malware type
- credential-stealer, spyware
- Family
- Malware family
- Operating systems
- windows
- Profile updated
- 2026-07-07 14:52:08
Targeted industries: financial-services retail-and-hospitality
Targeted regions: country_code:br
Context
Chaes is a multistage information stealer written in several programming languages that collects login credentials, credit card numbers, and other financial information. Chaes was first observed in 2020, and appears to primarily target victims in Brazil as well as other e-commerce customers in Latin America.
Detection coverage
- 561 Sigma rules
Malware & tools used
- Msiexec (attack-pattern)
- Malicious File (attack-pattern)
- Standard Encoding (attack-pattern)
- Encrypted Channel (attack-pattern)
- Native API (attack-pattern)
- InstallUtil (attack-pattern)
- Visual Basic (attack-pattern)
- Spearphishing Attachment (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- Exfiltration Over Alternative Protocol (attack-pattern)
- Python (attack-pattern)
- Steal Web Session Cookie (attack-pattern)
- Match Legitimate Resource Name or Location (attack-pattern)
- Template Injection (attack-pattern)
- Modify Registry (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- Input Capture (attack-pattern)
- DLL (attack-pattern)
- Fileless Storage (attack-pattern)
- Web Protocols (attack-pattern)
- Windows Command Shell (attack-pattern)
- JavaScript (attack-pattern)
- Browser Session Hijacking (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Screen Capture (attack-pattern)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Chaes (report)
- cybereason.com — 11 2020 Chaes E Commerce Malware Research (report)
- morphisec.com — Chae$ Chronicles Chaes4.1 (report)
- blog.morphisec.com — Chaes4 New Chaes Malware Variant Targeting Financial And Logistics Customers (report)
- blog.morphisec.com — Chaes Chronicles (report)
- decoded.avast.io — Chasing Chaes Kill Chain (report)
- MITRE ATT&CK — S0631 (report)