MalwareUsed by 1 actor

Chae$ 4

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lucifer

Morphisec Threat Labs identified Chae$ 4, an advanced and previously unknown variant of the Chaes malware... In January 2023, Morphisec identified an alarming trend where numerous clients, primarily within the logistics and financial sectors, were under the onslaught of a new and advanced variant of Chaes malware.

via morphisecblog.morphisec.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

T1055Process InjectionEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Added layers of encryption and increased stealth capabilities

T1036MasqueradingEvidence1

The infection starts by executing a malicious, almost undetected, MSI installer that usually pretends to be a JAVA JDE installer or Anti-Virus software installer.

T1055Process InjectionEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

T1620Reflective Code LoadingEvidence1

Predominant shift to Python, which undergoes decryption and dynamic in-memory execution

Credential Access

2 techniques

T1056Input CaptureEvidence1

Chronod module – a credential stealer and clipper. This module is responsible for intercepting browser activity to steal information from the user such as credentials sent on the login process, banking information when communicating with the bank’s website

T1555Credentials from Password StoresEvidence1

Stealer module – responsible for stealing data from Chromium-based browsers. Stolen data includes login data, credit cards, cookies, and autofill.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

Init module – the first module sent by the attacker acts as an identification / new victim registration. It gathers an extensive amount of data on the infected system.

Collection

3 techniques

T1005Data from Local SystemEvidence1

Stealer module – responsible for stealing data from Chromium-based browsers. Stolen data includes login data, credit cards, cookies, and autofill.

T1056Input CaptureEvidence1

T1115Clipboard DataEvidence1

Chronod module – a credential stealer and clipper... and has a clipping functionality that tries to steal BTC, ETH and PIX transfers.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

Adoption of WebSockets for primary communication between the modules and the C2 server

T1105Ingress Tool TransferEvidence1

Execution of the malicious installer will cause the malware to deploy and download its required files inside a dedicated and hard-coded folder under the %Appdata%/<protuhuese_name> folder.

T1568Dynamic ResolutionEvidence1

Implementation of DGA for dynamic resolution of the C2 server’s address

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

File upload module – has the capability to search and upload files from the infected system to the C2 server.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

morphisecNews

Apr 21, 2025

Chae$ 4: New Chaes Malware Variant Targeting Financial and Logistics Customers

A major new variant of Chaes rewritten largely in Python with improved modularity, stealth, encryption, WebSocket-based C2 communications, and DGA-based C2 resolution. It deploys via a malicious MSI installer, establishes persistence through scheduled tasks, migrates into targeted processes, and loads multiple modules for victim profiling, beaconing, credential theft, browser interception, cryptocurrency clipping, browser data theft, and file exfiltration including MetaMask-related data.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Chae$ 4

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lucifer

via morphisecblog.morphisec.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

T1055Process InjectionEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Added layers of encryption and increased stealth capabilities

T1036MasqueradingEvidence1

The infection starts by executing a malicious, almost undetected, MSI installer that usually pretends to be a JAVA JDE installer or Anti-Virus software installer.

T1055Process InjectionEvidence1

ChaesCore — that is responsible for setting persistence using Schedule Task and migrating into targeted processes.

T1620Reflective Code LoadingEvidence1

Predominant shift to Python, which undergoes decryption and dynamic in-memory execution

Credential Access

2 techniques

T1056Input CaptureEvidence1

T1555Credentials from Password StoresEvidence1

Stealer module – responsible for stealing data from Chromium-based browsers. Stolen data includes login data, credit cards, cookies, and autofill.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

Init module – the first module sent by the attacker acts as an identification / new victim registration. It gathers an extensive amount of data on the infected system.

Collection

3 techniques

T1005Data from Local SystemEvidence1

Stealer module – responsible for stealing data from Chromium-based browsers. Stolen data includes login data, credit cards, cookies, and autofill.

T1056Input CaptureEvidence1

T1115Clipboard DataEvidence1

Chronod module – a credential stealer and clipper... and has a clipping functionality that tries to steal BTC, ETH and PIX transfers.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

Adoption of WebSockets for primary communication between the modules and the C2 server

T1105Ingress Tool TransferEvidence1

Execution of the malicious installer will cause the malware to deploy and download its required files inside a dedicated and hard-coded folder under the %Appdata%/<protuhuese_name> folder.

T1568Dynamic ResolutionEvidence1

Implementation of DGA for dynamic resolution of the C2 server’s address

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

File upload module – has the capability to search and upload files from the infected system to the C2 server.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

morphisecNews

Apr 21, 2025

Chae$ 4: New Chaes Malware Variant Targeting Financial and Logistics Customers

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.