{
  "family": "chopper",
  "sample_count": 14,
  "category": "backdoor",
  "description": "Chopper (widely tracked across cybersecurity research, CISA advisories, and EDR platforms as China Chopper, Backdoor:Win32/Chopper, and Trojan:ASP/Chopper) is a legendary, ultra-compact webshell and remote administration platform first documented in 2012. Measuring as small as 4 kilobytes (or a single line of text, e.g., eval(request(\"cmd\")) in ASPX or eval($_POST[\"cmd\"]) in PHP), Chopper delivers full server management capabilities when paired with its specialized Windows GUI client (chopper.exe). The Windows client interacts with the server-side payload over standard HTTP POST requests, enabling operators to browse and manipulate the remote filesystem, execute interactive command-line commands, transfer files, dump database contents via embedded SQL query interfaces, and initiate lateral movement across corporate networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Chopper",
    "China Chopper",
    "Trojan:ASP/Chopper",
    "Win32/Chopper",
    "China Chopper Web Shell"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Chopper (China Chopper)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "China Chopper is an ultra-compact webshell and remote administration tool client widely used by APT groups and cybercriminals."
      }
    },
    {
      "@type": "Question",
      "name": "How does the China Chopper client communicate with the webshell?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The Windows client transmits command payloads inside HTTP POST parameters disguised as ordinary web requests."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does China Chopper provide to attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "File browsing and modification, arbitrary command-line execution, database query management, and traffic tunneling."
      }
    },
    {
      "@type": "Question",
      "name": "Why is China Chopper so difficult to detect statically?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The server-side component is as short as one line of code, blending easily into legitimate web application scripts."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect China Chopper activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Inspect web server access logs for anomalous HTTP POST requests with executable code or base64 parameters, and monitor process spawning from w3wp.exe."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1505.003",
    "T1059.003",
    "T1059.001",
    "T1071.001",
    "T1083"
  ],
  "cisa_advisory": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200a",
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1505.003",
      "name": "Server Software Component: Web Shell",
      "tactic": "Persistence"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Base64 POST Data)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the compromised web server from the internal network immediately to prevent lateral movement, but keep it online to capture live traffic logs.",
    "Analyze IIS/Apache access logs to identify the exact file path of the web shell (look for high volumes of POST requests to a specific file).",
    "Review the web server process execution logs (EDR) to identify what commands the attacker executed via `cmd.exe` or `powershell.exe`.",
    "Once the shell is located, remove the malicious code, but more importantly, identify and patch the initial vulnerability that allowed the upload (e.g., an unpatched CMS plugin)."
  ],
  "what_to_avoid": [
    "Do not simply delete the web shell file and put the server back into production; the attacker will immediately exploit the same vulnerability to upload a new shell.",
    "Avoid relying solely on file-based antivirus to find web shells; a one-line PHP `eval()` statement is often not flagged as malicious by static scanners."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "persistence",
    "command_and_control",
    "remote_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "CISA Alert (AA21-200a) - China Chopper Web Shell Analysis",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200a"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/Chopper",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Chopper"
    },
    {
      "name": "MITRE ATT&CK - Server Software Component: Web Shell (T1505.003)",
      "url": "https://attack.mitre.org/techniques/T1505/003/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}