Chaes
- ID
- S0631
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
Chaes is a multistage information stealer written in several programming languages that collects login credentials, credit card numbers, and other financial information. Chaes was first observed in 2020, and appears to primarily target victims in Brazil as well as other e-commerce customers in Latin America.[1]
Techniques used (28)
- T1027.011 Fileless Storage
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1048 Exfiltration Over Alternative Protocol
- T1056 Input Capture
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1112 Modify Registry
- T1113 Screen Capture
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1185 Browser Session Hijacking
- T1204.002 Malicious File
- T1218.004 InstallUtil
- T1218.007 Msiexec
- T1221 Template Injection
- T1539 Steal Web Session Cookie
- T1547.001 Registry Run Keys / Startup Folder
- T1555.003 Credentials from Web Browsers
- T1566.001 Spearphishing Attachment
- T1573 Encrypted Channel
- T1574.001 DLL