Signature Detail

Short Name	TROJAN:BACKDOOR:CHINACHOPPERCNC
Severity	High
Recommended	Yes
Recommended Action	Drop
Category	TROJAN
Keywords	China Chopper Webshell Command and Control Traffic
Release Date	2015/08/24
Update Number	2528
Supported Platforms	idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+

TROJAN: China Chopper Webshell Command and Control Traffic

This signature detects the Command and Control traffic for the Win.Backdoor.Chopper Webshell Trojan. The source IP host is infected and should be removed from the network for analysis.

References

URL: https://www.exploit-db.com/docs/27654.pdf
URL: http://informationonsecurity.blogspot.in/2012/11/china-chopper-webshell.html
URL: https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html

Signature Detail

Short Name

Severity

Recommended

Recommended Action

Category

Keywords

Release Date

Update Number

Supported Platforms

TROJAN: China Chopper Webshell Command and Control Traffic

References