China ChopperMalware
China Chopper is a Web Shell hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server. It has been used by several threat groups.From MITRE ATT&CK
Last reported 1 month ago, by Sophos X-Ops4 reports
ATT&CK techniques
6 of 26 · each with the sentence it comes from- T1505.003Web Shell
“Deploy web shells”
- T1053.005Scheduled Task
“# Hunt for scheduled task or service from a suspicious path:”
- T1003OS Credential Dumping
“OS credential dumping: NTDS”
- T1003.002Security Account Manager
“OS credential dumping: Security Account Manager”
- T1003.006DCSync
“Potential Credential Access via DCSync”
- T1007System Service Discovery
“System service discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Dissecting a PHP web server rootkit“China Chopper, for example, is a well-known web shell that MITRE describes as providing access through web servers and supporting behaviors such as HTTP POST command execution, file operations, and command-terminal access.”
-
The Crown Prince, Nezha“…que called log poisoning (also referred to as log injection) to plant a basic evaluation web shell (also commonly referred to as the China Chopper web shell) on a web server.”
-
SiestaGraph: New implant uncovered in ASEAN member foreign ministry“Other attempts were observed to load obfuscated versions of the China Chopper and Godzilla web shells.”
-
Rapid Response: Mass Exploitation of On-Prem Exchange Servers“These reports also included Assisted Remediation playbooks that will remove the “China Chopper” ASPX webshells that we discovered.”
Indicators in its reports
named in the reports above- 26bd5b0722d1dbab…b3d6d57bccc9in 1 report
- 54.46.50[.]255in 1 report
- 6f336f372c5a642b57413363265e7d7ein 1 report
- 45.207.220[.]12in 1 report
- c.mid[.]alin 1 report
- host.404111[.]xyzin 1 report
- gd.bj2[.]xyzin 1 report
- bj2[.]xyzin 1 report
- 38.246.250[.]201in 1 report
- f3570bb6e0f9c695…3ffd9fd7ad16in 1 report
- hxxps://rism.pages[.]dev/microsoft.exein 1 report
- rism.pages[.]devin 1 report
- 9f33095a24471bed…14efcd9e7de6in 1 report
- 7b2599ed54b72dae…5e4606dbc958in 1 report
- 82611e60a2c5de23…a84031d87999in 1 report
- 35e0b22139fb27d2…5ff8fce210f3in 1 report
- 172.245.52[.]169in 1 report
- 17a077eab538ca80…687b573042cain 1 report
- 92d17848f4c0fd4d…abb1a39badc1in 1 report
- 18f85477f7edad2c…cc3249799cf2in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.