Chopper

Overview

Backdoor:ASP/Chopper (or PHP/Chopper) refers to the infamous 'China Chopper' web shell. Discovered around 2012, China Chopper is a tiny, incredibly stealthy, and highly capable web shell extensively used by advanced threat actors, particularly Chinese state-sponsored APTs (like Hafnium and APT27), to maintain persistent, remote administrative access to compromised internet-facing web servers (IIS, Apache, Nginx).

Understanding China Chopper
To a server administrator, a Chopper infection is nearly impossible to spot casually. The server payload is remarkably small—often literally a single line of PHP, ASP, or ASPX code hidden inside a massive, legitimate web file. For a threat hunter, China Chopper represents a severe, post-exploitation foothold. The attacker uses a dedicated, GUI-based client application (the Chopper Client) to connect to that single line of code, granting them full file system browsing, database management, and virtual terminal access (command execution) on the compromised server.

Execution and Stealth Mechanics
Attackers typically deploy the Chopper payload (`T1505.003`) after exploiting a vulnerability in a web application (e.g., SQL Injection, unpatched Exchange Server vulnerabilities like ProxyLogon). The payload itself is simple: it uses the `eval()` function (or equivalent) to execute code sent via an HTTP POST request. Example PHP payload: `[REDACTED]` To communicate, the attacker's client sends an HTTP POST request containing heavily encoded command execution logic (often Base64 encoded inside the POST body) (`T1059`). The web server's application pool executes the command and returns the output in the HTTP response. Because the traffic looks like standard web POST requests, it easily bypasses traditional firewalls.

Indicators of Compromise & Impact
The impact is total control of the web server and a launchpad for lateral movement into the internal network. Incident responders will not find a traditional `.exe` malware file. Defense relies on Web Application Firewall (WAF) logs and IIS/Apache access logs. Look for repetitive HTTP POST requests to a specific, unusual file (e.g., an image file or a deeply buried `.aspx` file) originating from a single IP address. EDR platforms should flag the web server worker process (`w3wp.exe` or `httpd`) spawning suspicious child processes like `cmd.exe` or `powershell.exe`.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_CHOPPER {
    meta:
        description = "Detects Chopper (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "chopper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Chopper Activity
id: 37e4dd20c310142564fc483db1132f36
status: experimental
description: Detects generic indicators of the chopper malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*chopper*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the compromised web server from the internal network immediately to prevent lateral movement, but keep it online to capture live traffic logs.
2. Analyze IIS/Apache access logs to identify the exact file path of the web shell (look for high volumes of POST requests to a specific file).
3. Review the web server process execution logs (EDR) to identify what commands the attacker executed via `cmd.exe` or `powershell.exe`.
4. Once the shell is located, remove the malicious code, but more importantly, identify and patch the initial vulnerability that allowed the upload (e.g., an unpatched CMS plugin).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not simply delete the web shell file and put the server back into production; the attacker will immediately exploit the same vulnerability to upload a new shell.
2. Avoid relying solely on file-based antivirus to find web shells; a one-line PHP `eval()` statement is often not flagged as malicious by static scanners.

References & External Analysis

• Search "chopper" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: backdoor)

Explore other malware families in the same category:

• Doublefantasy
• Hawkeyekeylogger
• Koutodoor
• Teamspy
• Adduser

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/chopper.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.