Chaes Banking Trojan Invade Chrome Browser And Installs Malware Extensions.

Avast researchers Anh Ho and Igor Morgenstern reported that ,” Chaes is separated by its multi-stage delivery, which employs scripting frameworks such as JScript, Python, and NodeJS, binaries written in Delphi and malicious Google Chrome extensions.  ‘ Chaes’ ultimate goal is to steal credentials stored in Chrome and hijack logins to popular Brazilian banking websites.”

Chaes is a banking trojan that only operates in Brazil and was discovered by Cybereason in November 2020. Avast detected an increase in Chaes activity in Q4 2021, with infection attempts detected from over 66,605 of our Brazilian customers. During our investigation, we discovered that the malware is distributed through a large number of compromised websites, including well-known ones.

Avast discovered Chaes’ artefacts on over 800 websites. Over 700 of them have Brazilian TLDs. All of the compromised websites are WordPress sites, which leads us to believe that the attack vector could be the exploitation of WordPress CMS vulnerabilities. However, unable to conduct forensics to confirm this theory. We immediately reported our findings to the Brazilian CERT (BR Cert) in the hopes of preventing future incidents.

The info-stealing malware, first identified by Cybereason is delivered through a sophisticated infection chain designed to harvest sensitive consumer information such as login credentials, credit card numbers and other financial information.

Some of the intermediary payloads are not only encrypted, but they are also hidden as commented-out code within the HTML page of a Blogger blogspot domain (“awsvirtual[.]blogspot.com”). Finally, a JavaScript dropper downloads and installs up to five Chrome extensions ,

• Online – A Delphi module used to fingerprint the victim and transmit the system information to a command-and-control (C2) server.
• Mtps4 (MultiTela Pascal) – A Delphi-based backdoor whose main purpose is to connect to the C2 server and wait for a responding Pascal Script to execute.
• Chrolog (ChromeLog) – A Google Chrome password stealer written in Delphi.
• Chronodx (Chrome Noder) – A JavaScript trojan that, upon detecting the launch of Chrome browser by the victim, closes it immediately and reopens its own instance of Chrome containing a malicious module that steals banking information.
• Chremows (Chrome WebSocket) – A JavaScript banking trojan that records keypresses and mouse clicks on Chrome with the goal of plundering login credentials from users of Mercado Livre and Mercado Pago.

Avast stated that the attacks are still ongoing and that it had shared its findings with the Brazilian CERT in order to halt the spread of the malware. Nonetheless, Chaes-related artefacts can still be found on some of the infected websites.

Finally the researchers concluded that ,” Chaes exploits many WordPress-powered websites to serve malicious installers. The Google Chrome extensions are capable of stealing users’ Chrome credentials and collecting users’ banking information from popular banking websites.”

Indicator Of Compromise

SHA256 Hashes

Filename	Hash
MSI installer	f20d0ffd1164026e1be61d19459e7b17ff420676d4c8083dd41ba5d04b97a08c 069b11b9b1b20828cfb575065a3d7e0b6d00cd1af10c85c5d6c36caea5e000b7 1836f3fa3172f4c5dbb15adad7736573b4c77976049259cb919e3f0bc7c4d5ea 02831471e4bf9ef18c46ed4129d658c8ce5b16a97f28228ab78341b31dbef3df a3bcbf9ea2466f422481deb6cb1d5f69d00a026f9f94d6997dd9a17a4190e3aa 62053aeb3fc73ef0940e4e30056f6c42b737027a7c5677f9dbafc5c4de3590bd e56a321cae9b36179e0da52678d95be3d5c7bde2a7863e855e331aea991d51b9 7a819b168ce1694395a33f60a26e3b799f3788a06b816cc3ebc5c9d80c70326b
__init__.py	70135c02a4d772015c2fce185772356502e4deab5689e45b95711fe1b8b534ce 6e6a44ca955d013ff01929e0fa94f956b7e3bac557babcd7324f3062491755e2 0b5646f45f0fad3737f231f8c50f4ed1a113eb533997987219f7eea25f69d93f abc071831551af554149342ad266cc43569635fb9ea47c0f632caa5271cdf32
runScript.js	bd4f39daf16ca4fc602e9d8d9580cbc0bb617daa26c8106bff306d3773ba1b74
engine.js	c22b3e788166090c363637df94478176e741d9fa4667cb2a448599f4b7f03c7c
image	426327abdafc0769046bd7e359479a25b3c8037de74d75f6f126a80bfb3adf18 3311b0b667cd20d4f546c1cb78f347c9c56d9d064bb95c3392958c79c0424428 c9b3552665911634489af5e3cb1a9c0c3ab5aed2b73c55ae53b8731a1de23a9f
chremows	fa752817a1b1b56a848c4a1ea06b6ab194b76f2e0b65e7fb5b67946a0af3fb5b e644268503cf1eaf62837ec52a91b8bec60b0c8ee1fb7e42597d6c852f8b8e9d bd5d2a0ec30fa454af1a086b4c648039422eca4fa1b1d6e8ecc4d47be7fab27f 4d2ffae69b4e0f1e8ba46b79811d7f46f04bd8482568eccf5620e6b1129c1633 faad384e124c283a8d024ee69dceaac877be52f5adbf18ca6b475a66663b0e85 969fa30802bdb81be5b57fef073896c2ee3df4211663301548f8efa86257e0cf 5a1ebf757ab9aa796a8580daafab9635660b9cc55505db194cbfefeb612e48f0 2d9e040820acca9a0fab2dc68546e0a824c4c45ee8c62332213e47e1f6923c90 e1d9effa8a56d23dbcefd2146eb5c174a245b35a4f718473452135bd064a2157 32c545e133183e6fc999e8f6a0da3c6e7fb1a12b97d2a3bbc5e84faa175a9ef6 ba3e0314b1d6e6ee10c473c1bbd883c4a5c53b5703b5ced174cd5a30b0b87160 e210217f2b5912e16a281dcbd5a5247fe2a62897dc5c2e1bf4ff61d3a07405f0 7a1d74c4d62ceee45a3cbaf79070cfc01342a05f47e0efb401c53040897bed77 550188ad28ccc07791880777c2de07e6d824a7263b9e8054423597b160e594a3 9603c4ce0f5a542945ed3ced89dd943eb865368b4e263090be9e0d9c1785615d
chrolog	9dbbff69e4e198aaee2a0881b779314cdd097f63f4baa0081103358a397252a1 6dc63ea4dbe5d710b7ba161877bd0a3964d176257cdfb0205c1f19d1853cc43b 3e48f714e793b3111ce5072e325af8130b90a326eca50641b3b2d2eba7ac0a45 754eeb010795c86d1cc47b0813da6bbc6d9153f1dd22da8af694a9e2dca51cda 0762038fe591fef3235053c7136f722820de6d8457cae09d4aa9bf6cb7f497a1
chronod	ea177d6a5200a39e58cd531e3effb23755604757c3275dfccd9e9b00bfe3e129 7c275daab005bb57e8e97ac98b0ae145a6e850370e98df766da924d3af609285 96224c065027bb72f5e2caebf4167482fe25fb91c55f995e1c86e1c9884815c3 2688a7ac5b408911ae3e473278ecbc7637491df2f71f6f681bc3ed33045b9124 f3c1fd9e8674901771c5bfc4ce16eba75beff7df895a4dc6fdd33bedb2967a08 ddecc2606be56beae331000ba091e5e77ae11380f46eba45387c65289e6ce421 debe443266ab33acb34119f515f4622464edff198f77fd20006e2d79aafb6dfc bf4a83a19065d5c45858ceb988dce39d93c412902ead6434e85fbf2caa17db44 87502ad879a658aa463088c50facfbdbb1c6592263e933b8b99e77293fdf1384 6b6abc64053d20306147efced9df2ef75153e87a1d77ce657943b2373fb4ffb9 679a02d0ae4f5382767eb11cefad59c0664f55ed2ce3e3b3df97b78c09e18aa3 564b31c3d609d96a73ee139ec53453b985673ffacacb56ecd13d2c83bbf851e0 e649f71b68cc54f3d985e398f1c6354963ec027a26230c4c30b642d2fd5af0a6
online	3fd48530ef017b666f01907bf94ec57a5ebbf2e2e0ba69e2eede2a83aafef984
mtps4	5da6133106947ac6bdc1061192fae304123aa7f9276a708e83556fc5f0619aab

–-For more Cyber security news in crisp content . Please follow our site via twitter handle @cyberworkx1, Linkedin handle @linkedin