topic ChinaCopper and General Discussion on PA Threat DB in Advanced Threat Prevention Discussions

ChinaCopper and General Discussion on PA Threat DB

GStach — Tue, 10 Oct 2017 13:18:42 GMT

So we get an alert today for ChinaCopper.Gen C&C inbound traffic. In doing research to see what this is, we look at the Threat DB, only to find the description of ChinaCopper.Gen to be: "This signature detects ChinaCopper.Gen Command and Control Traffic. " No other information, and no matter how I search the Internet I only get information on metal copper coming out of China.

Am I missing anything on where to search for what these are? And is anyone else frustrated at the lack of info in the ThreatDB?

Re: ChinaCopper and General Discussion on PA Threat DB

kkawachi — Thu, 19 Oct 2017 03:53:33 GMT

Hi GStach,

Sorry for the confusion.

ChinaCopper.Gen Command and Control Traffic is not proper name. Should be ChinaChopper.Gen Command and Control Traffic. We already noted and now working to fix.

I believe that the following URLs gives detailed infromation about ChinaChopper.Gen Command and Control Traffic

https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html
https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-china-chopper.pdf

Best

-Koji