Chae$ Chronicles - Director's cut

[psychlo]

Hello, comrades.

I am psychlo. One of the programmers behind the chaes malware.
Since 2020 we have been in the wild.
We appeared on the news for the first time on november 17th 2020, when our software was analysed by cybereason.

[https://www.] cybereason[.]com/threat-alert-chaes-e-commerce-malware
There is full pdf with details.

In january 25th 2022 we had a new analysis now by avast:

[https://] decoded[.]avast[.]io/anhho/chasing-chaes-kill-chain/

We blogged about it on a blogspot we control and used back in the days to put some c2 information hidden inside the html so the victims could find the servers.

[https://] awsvirtual[.]blogspot[.]com/

Last but not least, this year we had a new analysis, this time by morphisec.

[https://] blog[.]morphisec[.]com/chaes4-new-chaes-malware-variant-targeting-financial-and-logistics-customers

What can I say, I just love the attention and the analysis always make me want to improve the work we make.
Reading the analysis we can find what is being easy to find and what they didn't find. So we know what we have been doing right and what we should improve.

Now, why am I posting this here?

Well, first because I like the feeling... I guess in the end that is something all of us enjoy... the stories, the drama, the news... just knowing that there are some people getting paid to reverse my malware, write about it... it makes me smile...
On the other hand... Hido Cohen was talking to an old man in the video presentation and the old man asked "why do they focus only in Brazil?"

He has a point...

So... If anyone here has any idea, maybe we could join forces... we could share some information... currently we only target brazil financial systems but we are up to know about other possibilities...
Banking security in brazil is pretty serious, they spend tons of money with high end solutions to prevent fraud. I believe there are easier countries out there where people are not so malicious as brazilians are...

Think about canadians... western european people... they are pretty innocent about data theft.. they trust a lot more, at least that is what I think...
anyway...

I intend to keep up this post with more stories, maybe updates... I enjoy writing about this..
would love to chat about malware scene and maybe think about new ideas, possibilities to explore...
besides the competition for money, most of us, those who have been here for a while... we are here because we love this...

money comes and goes... but hacking is a part of us...
I would love to talk with you guys because I know that deep inside we share the same passion for code, computers, data and money.

Feel free to share your own thoughts below.

I wish I could speak russian. I have been doing classes but there is a big distance between learning the basics and being able to communicate in a cyber security forum. I hope I get there someday.

Best regards.

 

[psychlo]

I have been on the scene for a while, I specially remember the days of the hackhound, ic0de... times when I was enjoying coding in delphi... I was so young hahaha...
I dont know if the guys from those times just left the scene or they just dont talk publicly anymore... anyway I hope I can connect with these people like me and we can share experiences, stories... even if it is just for fun... after all that is why we started all of this... right!?

I wonder where people like steve10120, aphex... where are these guys? I mean, they just left!? I doubt..

 

[psychlo]

I will use this thread to expose a little bit of my thoughts and eventually I am certain that these words are going to meet the right people.

xss is the blackhole for real hackers... eventually every real hacker will end up registering an account here and at least take a look around.
so eventually some people sharing the same burning desire as me will read this post.

Hello, my friend. Finally we meet.

As I said before I believe we do this for more than just money. Money is good but real hackers want subversion. We are, in the end, agents of chaos.

I use very often the term "real hackers" because today unfortunately we have these corporate employees from cyber security who call themselves hackers.
They might even have the same, or even more skill than real hackers do, they might be just as creative as real hackers are but they lack the essential characteristic of a hacker: system subversion.

They are employees, or they are providing services for those corporate business. In the end they are not against the system, they are part of the system.

So... now that we have a common ground, lets continue.

We want fun, we want to set the systems on fire. Ultimately we dont really want to destroy the system. We love them. Because we like to play with them. We need them.
But we dont want them sitting there peacefully living among sunshine and rainbows.
We want them on fire. Screaming for help. Just loud enough to be fun but not badly desperate to disappear.

Well, I have been thinking and I am certain that we need to create ecosystem of tools designed for us, real hackers.
In the competition for money, we, many times, keep things privately and in the dark from our competitors (other hackers) but at the same time, the cyber security industry is pretty aware of those things we keep private.
So in the end we are just hiding from ourselves old techniques and tools that eventually stop working.
As a community we can go so much further if we create tools that are capable of being used and developed by everyone.

My goal is to create what I call Develop and Deploy Malware.
That is what will set the line between us and them.
So I want feedback from everyone that is willing to contribute.
It doesnt matter your level, maybe we are luck enough to have someone god-like, like bratva to shout out some ideas and enjoy the project. Or maybe just a fresh registered script kid that just heard couple days ago about sql injection.

I dont plan to make this your life plan, your main objective in life. But maybe just a fun side project that you might want to contribute for when you have some time available and the pocket is already full of money.

I am completely open for suggestions as I believe in hackers. I believe that we can find the best direction based on sharing experiences and knowledge.

I have an initial idea but as I said I am open.
The idea is to create an ecosystem of tools that can be assembled together for different purposes.
Imagine a lego (toy) https://en.wikipedia.org/wiki/Lego

We create the building blocks of malware. To be something flexible that can go from something as simple as ransonware, to something as complicated as duqu.

As we are all probably aware of, the cyber security industry has some pretty fancy tooling available for red teams. One remarkable example is cobalt strike.
I see a lot of interest in it specially from script kiddies who want something easy to use.

And I dont blame or exclude script kiddies from the game. I mean, if we are humble enough to admit, we all have been there before, right!?
Well I can say for myself. Today I write my own code but I have used copied and pasted code back in the days. I have used tools without having any idea how to build something like that.

They are part of us. They are just us in the past. We cant neglect them. We have to embrace them and develop them into us. They are the future. If we exclude them, they will be recruited to be script kidding for the corporate world. The corporate world has no scruples. They dont care for values, knowledge, merit. They care for results. We do this for fun.

So, lets get back on track:

The initial idea would be to create a flexible and easy to configure payload just like the heart of cobalt strike.
This payload would be developed thinking ahead. Thinking about the needs of the malware community always with this intention in mind: DEVELOP AND DEPLOY MALWARE

We are not here to write reports;
We are not here to simulate other threats;
We are not here to simulate at all;
We are here to cause mayhem.

Some will use our tools and make us proud, others not so much. It doesnt matter. They will not be able to escape our main intention: DEVELOP AND DEPLOY MALWARE

So, my dear friends who share the same burning passion for computers and hacking, I will wait for ideas. If you are shy, then hit me with an email at chaesteam [at] proton.me

I will post your ideas here keeping your name out if you wish.
It is time for us to beat those fuckers for good. It is time for us to make tools where each one of us can focus in one part of what interests each one the most while others are paying the same attention and focus on other parts and together we can build a war machine.

A cyberwar machine.

One million dolar isnt cool. You know what is cool?
power

but dont worry, if money is what truly motivates you... there will be opportunity for you as well... an ecosystem of tools that are possible to combine can be composed of free open source tools just as much as closed proprietary extensions that can be purchased and attached to it.

If we think about it as a biological virus, we can think about what I want to build as the DNA. The results are done by the RNA, because they are the part that actually do the work. In computers we can compare RNA with shellcode. And DNA as the framework, the source code. The makefile. The instructions that can be put into production to produce results.

We need these set of instructions, that recipe book. When you are going to cook you dont cook the entire recipe book at once. You pick one entrance, one main dish and one dessert. You write down those recipes you selected from the book and execute them. At the first you follow them but eventually you might start doing customizations. The idea is the same.

we can build it. but there is only one way to do this and it is together.
Please let me know your thoughts. If you think I am an idiot, then tell me this and why... and maybe you will convince me to change the direction.
One thing is for sure: I AM DOING THIS.
I have all the money I will need until I die. And I know that there is nothing in the world I am more passionate about than coding and hacking.
So yeah, that is what I will be doing. The only question is, do you want to put your contribution into it? Do you have ideas on how to make my idea better? More effective? More flexible? More acute?
The blank space below is waiting for you to create the future you want to see.

 

[Dread Pirate Roberts]

so you want a Github for malware or what?

as for the direction, private things are kept private for a reason: as soon as you publish something it will be added to every single antivirus and Intrusion Prevention/Detection System.
so I would vouch for staying private.

 

[psychlo]

Посмотреть вложение 70956


so you want a Github for malware or what?

as for the direction, private things are kept private for a reason: as soon as you publish something it will be added to every single antivirus and Intrusion Prevention/Detection System.
so I would vouch for staying private.

I used to think that but if this was true, tools like cobalt strike itself would not exist...

look:

Cobalt Strike and YARA: Can I Have Your Signature? | Cobalt Strike

Get OPSEC considerations for using Beacon with in-memory YARA scanning and learn a malleable C2 profile that gives robust evasion against such defensive techniques.

www.cobaltstrike.com

this kind of confirms my previously statement:

In the competition for money, we, many times, keep things privately and in the dark from our competitors (other hackers) but at the same time, the cyber security industry is pretty aware of those things we keep private.
So in the end we are just hiding from ourselves old techniques and tools that eventually stop working.

if we make things private, we believe they are safe but the truth is that we are just hiding it from each other... the cyber security industry when one guy tags your stuff, all the solutions tag it...
they share everything...

there are ways to create safety mechanisms to encrypt and protect our payloads, even if the source code or the plain payload is known... just like they do with cobalt strike...
we can use the same techniques and each final user could set different options and customize safety mechanisms enough to keep under the radar...

by being bold and having a community we have much better chance of beating them... if we hide we are just fooling ourselves and lying to ourselves in belief that our hidden private tools and methods arent already known by security companies..

as I said, if they can be commercial and still evade... we could do it even better...

on the other hand:

the idea is not to create a github.. the idea is to create an ecosystem... a standard to connect pieces that could work together...

for example:


think about different pieces of a malware system:

LOADER
BEACON/IMPLANT
PERSISTANCE
STEALER
RANSONWARE
DROPPER
CLIPPER
RAT
C2

all these tools might be used by different actors in different scenarios... not every actor will use all of these tools, probably will never use all of them at once..

now think about if we had an ecosystem where different teams, that may or may not know each other, knew a few standards of how to make the tools so they could be attached to each other...
if you could develop your rat or stealer without having to worry about antivirus scanners, disk or memory... if you could just focus on build the best c2 network communication while someone else works on some loader techniques that will work with the ecosystem beacon/implant...

this is possible if those teams know before hand how these tools will behave... some sort of protocol...

it is possible to do this... and become extremely effective...
to do this, it is necessary the input of people who uses and needs those tools to tell the developers what they need, how they need... so every piece of the ecosystem can be written think ahead...
if we are going to write a beacon, we must be able to add more than one way of communicating with c2... the more modular things are the more we can switch the pieces and make something unique everytime we need to build a final product to attack...

 

[psychlo]

anyway, having private parts is not forbidden as I said earlier... if we know how the tools connect... you can develop parts of it and sell them privately if you want... as long as they work with the tools of the same ecosystem...

lets say that you created a fucking awesome extensions for a beacon that improves communication to connect the victim to the c2 without raising any suspicious on the network...
you dont need to share the source code... you do maas... sell the service.. as long as you know how the loader works, how the beacon works and how can you plug your extension to it to make it tunnel the communication... you can do whatever you want...

that is my point... you dont need to create the full solution... you can work on your specialty because someone else will be working on the other parts... you just have to make compatible tools with each other...

it is just like computers in the end... you have different choices of cpu, motherboards, memory sicks, disks, keyboards, cases, power source... mouses screens... video cards, sound cards... in the end each individual can assembly almost an unique computer...
but the parts talk with each other....

that is an ecosystem...
parts that can talk to each other....
my idea is to do that... in the most modular level possible so we can assemble different breeds of malware by just tweaking some parts and connecting them...

 

[psychlo]

while we talk and plan, I will start coding a beacon like payload to communicate to a c2... something simple that will be a simple shellcode/blob in the end... the idea is to follow the same footsteps from cobalt strike on this first essay...
write a simple beacon in the form a payload... we will also write some basic loader to put that shellcode to use...
we will do that by following the article "writing optimized windows shellcode in c" (https://phasetw0.com/malware/writing-optimized-windows-shellcode-in-c/)

I will be traveling the next few days... when I am back I will write some code so we can start seeing something to evolve from... the first idea is to be an essay so we can grow from there into something more...

the first goal is to have a very basic and primitive LOADER/BEACON/C2 some requisites will be applied so even it will be simple, it should be at least something that is worth being coded...

 

[psychlo]

you know what is funny?
in a hacking forum, I got one reply from the dread pirate roberts
a ghost... since the original one is behind bars

and a security researcher who reached me on telegram... that makes me wonder...
this place has a lot of attention from cyber security fellows...

anyway I am back from my trip and I will continue as I said before, I believe we can create a bullet proof malware ecosystem...
if any security researcher is also interested in taking the red pill anonymously, just reach to me, I wont judge...

 

[m00r]

you know what is funny?
in a hacking forum, I got one reply from the dread pirate roberts
a ghost... since the original one is behind bars

and a security researcher who reached me on telegram... that makes me wonder...
this place has a lot of attention from cyber security fellows...

anyway I am back from my trip and I will continue as I said before, I believe we can create a bullet proof malware ecosystem...
if any security researcher is also interested in taking the red pill anonymously, just reach to me, I wont judge...

вы там слишком большого мнения об этих форумах
1. тебя буквально мало кто понимает помимо вайтов
2. декабрь у нас в россии все начинают бухать

 

[god osiris]

Bro, I have got some samples from Chaes.
You are amazing!
Are you the main dev?
I see many hackers saying that "python isn't good for hacking" or "if you wanna code malware, don't do it in python", you just proved that complex malwares can be coded in python.
Fucking amazing!

 

[marmalade]

Chaes has creative approach