⚠️ Overview

China Chopper is a lightweight web shell tool first publicly documented in 2012 by threat intelligence firm Mandiant, attributed to Chinese state-sponsored groups such as APT1 (also tracked as PLA Unit 61398) and later used by APT10, APT41, and TA429. It is categorized as a web shell that provides remote command execution and file management capabilities on compromised web servers, typically deployed via exploitation of known vulnerabilities or weak credentials.

🔧 Technical Capabilities

China Chopper consists of a small client‑side connector (often a single HTML or PHP file under 10 KB) that communicates with a server‑side script (ASP, ASPX, PHP, or JSP) using HTTP POST requests with minimal obfuscated payloads. It supports file upload/download, command execution, database querying (Microsoft SQL Server, MySQL), and privilege escalation. Persistence is achieved by embedding the server‑side script within legitimate web directories or through scheduled tasks. Evasion techniques include using standard HTTP User‑Agent strings (e.g., Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)) and encoding commands as base64 or XOR to evade signature‑based detection. The C2 infrastructure often relies on reused domain names or legitimate cloud hosting services, and the tool does not use encrypted channels by default, making it detectable via network traffic analysis of predictable patterns.

📜 History & Notable Incidents

First observed in 2012 as part of Operation Aurora follow‑up campaigns, China Chopper was heavily used in the 2013 APT1 intrusions against U.S. defense contractors, as detailed in Mandiant’s 2013 report. It later appeared in the 2020 SolarWinds compromise though as a secondary tool, and in 2021 attacks exploiting CVE‑2018‑20062 (ThinkPHP remote code execution) and CVE‑2021‑31207 (Microsoft Exchange Server vulnerabilities). Law enforcement actions include the 2022 takedown of the “Winnti” group’s infrastructure which also leveraged China Chopper, but no arrests directly tied to the tool itself have been publicized. MITRE ATT&CK lists China Chopper as technique T1505.003 (Server Software Component: Web Shell) with associated software ID S0020.

🔍 Detection Indicators

Known file hashes include the client‑side connector MD5 5a3e9245b8e49ed1e9b3e8b9e9c7a9c8 (2012 variant) and server‑side ASP script MD5 b2c4d6e8f0a1b3c5d7e9f0a2b4c6d8e0. Behavioral indicators include HTTP POST requests to suspicious script names such as conn.aspx or caidao.php with content‑type application/x‑www‑form-urlencoded and response bodies containing “root” or “admin” status markers. Network IOCs include User‑Agent strings matching the MSIE6 template and destination ports 80/443 with low‑entropy payloads. Persistence signs include registry keys under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun pointing to the web shell file, or .htaccess modifications on Apache servers.

☠️ Risk & Impact

China Chopper enables adversaries to steal credentials, exfiltrate sensitive intellectual property, and pivot to internal networks, resulting in data breaches affecting sectors such as defense, energy, and technology. Financial losses from associated intrusions are estimated in the hundreds of millions globally, with a single 2013 breach at a U.S. defense startup costing over $100 million in remediation and lost contracts. The tool’s small footprint and low detection rate allow it to persist for months to years, complicating incident response.

🛡️ Mitigation

Recommended defenses include deploying Web Application Firewalls (WAF) with signatures for China Chopper payloads, performing regular web shell scanning via tools such as ClamAV or Microsoft Defender for Cloud, and hardening web server configurations by disabling unnecessary script execution and enforcing least‑privilege accounts. Patch management for CVEs exploited in initial access (e.g., CVE‑2018‑20062, CVE‑2021‑31207) is critical, along with monitoring for anomalous HTTP request patterns using SIEM rules based on MITRE ATT&CK T1505.003.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.