ChChes — Malware Profile

ChChes is a Trojan that appears to be used exclusively by menuPass. It was used to target Japanese organizations in 2016. Its lack of persistence methods suggests it may be intended as a first-stage tool.

MITRE ATT&CK techniques (12)

• T1036.005 Match Legitimate Resource Name or Location
• T1057 Process Discovery
• T1071.001 Web Protocols
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1132.001 Standard Encoding
• T1547.001 Registry Run Keys / Startup Folder
• T1553.002 Code Signing
• T1555.003 Credentials from Web Browsers
• T1573.001 Symmetric Cryptography
• T1685 Disable or Modify Tools

IntelFusions coverage

• menuPass (APT10) Deploys Cobalt Strike via Encrypted Executables and DKMC Bitmap Shellcode in Dual-Wave Attacks on Japanese Organizations 2026-02-16

Attributed threat actors

• APT10

Read the full analysis on IntelFusions