Stupidc0de Backdoor

Stupidc0de Backdoor is the largest and most feature-complete tool in the corpus: 90 KB, 2030 lines of PHP, twelve distinct function modules, and zero authentication on any of them. It is the flagship of the Indonesian “Stupidc0de Family” collective, with five distinct handles embedded in the source — Putra-Attacker, Daryun, Shor7cut, Osvaldas, and Sinkaroid — alongside a contact email, a Facebook profile, and the group’s branded domain. No other tool in the collection leaks as many operator identities in a single file.

Capabilities

The menu spans the full spectrum of post-compromise operations: file management, command execution, config grabbing, domain enumeration, mass tools, cPanel utilities, bypass tools, file creation, RDP account creation, cross-account jumping, and a database dumper. Every module is available to any visitor without authentication. The tool also contains a WordPress admin password reset module that can change the admin credentials of any WordPress installation on the same server, and a zone-h.com mass-defacement notifier packed inside a gzinflate-compressed payload — automating the “claim” step of defacement campaigns.

The runtime dependency on PHP 5.6 is hard: the code uses eregi, mysql_connect, and each(), all removed in PHP 7.0. On modern servers the shell returns a 500 error. This is not a design choice — it is technical debt from the 2013-2014 era of shared hosting where PHP 5.x was universal. The tool was built for that ecosystem and never updated.

Supply-Chain Surface

The supply-chain surface is the most extensive in the corpus. Five functions perform runtime remote-includes: four fetch code from Pastebin URLs and one pulls from a GitHub repository. These are not one-time downloads — they execute on every invocation of the corresponding module. If any of the four Pastebin pastes or the GitHub account is compromised, every deployed Stupidc0de instance silently executes the replacement payload.

Vulnerabilities

The self-incrimination is extraordinary. A meta author tag, an email address, a Facebook profile, five separate handles, and a branded domain — all embedded in a file that ships with zero authentication. The name “Stupidc0de” is, in this context, not merely a brand. It is an accurate description.

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule webshell_stupidc0de {
    meta:
        description = "Stupidc0de Backdoor (Indonesian scene, 90KB full-featured)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/stupidc0de/"
        status      = "validated"

    strings:
        $title      = "Stupidc0de" ascii
        $family     = "Stupidc0de Family" ascii
        $author1    = "Putra-Attacker" ascii
        $author2    = "Daryun" ascii
        $author3    = "Shor7cut" ascii
        $author4    = "Sinkaroid" ascii
        $email      = "puputsc48@gmail.com" ascii
        $html_title = "-:- Backdoor -:-" ascii
        $css_class  = "class='coeg'" ascii
        $conf_dir   = "Stupidc0de-Conf" ascii

    condition:
        filesize < 120KB
        and ($title or $family or $html_title or $conf_dir)
        and ($author1 or $author2 or $author3 or $author4 or $email or $css_class)
}

MITRE ATT&CK

OHIIHO Threat Research.