China Chopper

Malware & Tools · China Chopper

· MalwareS0020 · Zararlı Yazılım

Type

malware

Techniques

Used By

9 groups

Platforms

Windows

Description

China Chopper is a Web Shell hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server.(Citation: Lee 2013) It has been used by several threat groups.(Citation: Dell TG-3390)(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)(Citation: Rapid7 HAFNIUM Mar 2021)

Tactic Coverage

stealth (2)discovery (2)command and control (2)collection (1)execution (1)credential access (1)persistence (1)

Used By (9 groups)

G0096APT41Wicked Panda, Brass Typhoon G0135BackdoorDiplomacy G0117Fox KittenUNC757, Parisite G0093GALLIUMGranite Typhoon G0125HAFNIUMOperation Exchange Marauder, Silk Typhoon G0065LeviathanMUDCARP, Kryptonite Panda G0129Mustang PandaTA416, RedDelta

Techniques (10)

T1005Data from Local System

collection

T1027.002Software Packing

stealth

T1046Network Service Discovery

discovery

T1059.003Windows Command Shell

execution

T1070.006Timestomp

stealth

T1071.001Web Protocols

command and control

T1083File and Directory Discovery

References

https://attack.mitre.org/software/S0020 https://us-cert.cisa.gov/ncas/alerts/aa21-200a https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html