^[3]

Based on similarities in reported malware behavior and open source reporting, it is assessed that the malware named HAYMAKER by FireEye is likely the same as the malware ChChes.^[4][5]

ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.^[1][2]

ChChes establishes persistence by adding a Registry Run key.^[3]

ChChes steals credentials stored inside Internet Explorer.^[3]

ChChes can encode C2 data with a custom technique that utilizes Base64.^[1][2]

ChChes can encrypt C2 traffic with AES or RC4.^[1][2]

ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.^[4]

ChChes can alter the victim's proxy configuration.^[3]

ChChes is capable of downloading files, including additional modules.^[1][2][4]

ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).^[3]

ChChes collects its process identifier (PID) on the victim.^[1]

ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.^[1][2][3]

ChChes collects the victim hostname, window resolution, and Microsoft Windows version.^[1][3]

^[3]