{
  "family": "chopper",
  "sample_count": 14,
  "category": "backdoor",
  "description": "Backdoor:ASP/Chopper (or PHP/Chopper) refers to the infamous 'China Chopper' web shell. Discovered around 2012, China Chopper is a tiny, incredibly stealthy, and highly capable web shell extensively used by advanced threat actors, particularly Chinese state-sponsored APTs (like Hafnium and APT27), to maintain persistent, remote administrative access to compromised internet-facing web servers (IIS, Apache, Nginx).<br><br><b>Understanding China Chopper</b><br>To a server administrator, a Chopper infection is nearly impossible to spot casually. The server payload is remarkably small—often literally a single line of PHP, ASP, or ASPX code hidden inside a massive, legitimate web file. For a threat hunter, China Chopper represents a severe, post-exploitation foothold. The attacker uses a dedicated, GUI-based client application (the Chopper Client) to connect to that single line of code, granting them full file system browsing, database management, and virtual terminal access (command execution) on the compromised server.<br><br><b>Execution and Stealth Mechanics</b><br>Attackers typically deploy the Chopper payload (`T1505.003`) after exploiting a vulnerability in a web application (e.g., SQL Injection, unpatched Exchange Server vulnerabilities like ProxyLogon). The payload itself is simple: it uses the `eval()` function (or equivalent) to execute code sent via an HTTP POST request. \nExample PHP payload: `[REDACTED]`\nTo communicate, the attacker's client sends an HTTP POST request containing heavily encoded command execution logic (often Base64 encoded inside the POST body) (`T1059`). The web server's application pool executes the command and returns the output in the HTTP response. Because the traffic looks like standard web POST requests, it easily bypasses traditional firewalls.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total control of the web server and a launchpad for lateral movement into the internal network. Incident responders will not find a traditional `.exe` malware file. Defense relies on Web Application Firewall (WAF) logs and IIS/Apache access logs. Look for repetitive HTTP POST requests to a specific, unusual file (e.g., an image file or a deeply buried `.aspx` file) originating from a single IP address. EDR platforms should flag the web server worker process (`w3wp.exe` or `httpd`) spawning suspicious child processes like `cmd.exe` or `powershell.exe`.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1505.003",
    "T1190",
    "T1059",
    "T1071.001",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1505.003",
      "name": "Server Software Component: Web Shell",
      "tactic": "Persistence"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Base64 POST Data)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the compromised web server from the internal network immediately to prevent lateral movement, but keep it online to capture live traffic logs.",
    "Analyze IIS/Apache access logs to identify the exact file path of the web shell (look for high volumes of POST requests to a specific file).",
    "Review the web server process execution logs (EDR) to identify what commands the attacker executed via `cmd.exe` or `powershell.exe`.",
    "Once the shell is located, remove the malicious code, but more importantly, identify and patch the initial vulnerability that allowed the upload (e.g., an unpatched CMS plugin)."
  ],
  "what_to_avoid": [
    "Do not simply delete the web shell file and put the server back into production; the attacker will immediately exploit the same vulnerability to upload a new shell.",
    "Avoid relying solely on file-based antivirus to find web shells; a one-line PHP `eval()` statement is often not flagged as malicious by static scanners."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}