unzipper

unzipper is a legitimate PHP utility for extracting ZIP and archive files through a web interface. Its intended use case is deployment: upload a ZIP of your web application, point unzipper at it, extract in place. Shared hosting environments where SSH access is unavailable make this kind of tool common — upload via FTP, extract via browser. The original tool has no authentication at all — anyone who can reach the URL can extract archives.

Capabilities

Web-based archive extraction. ZIP file upload and in-place extraction through a browser interface. No authentication — anyone who can reach the URL can extract archives. Designed for shared hosting where SSH is unavailable.

W0rm Supply-Chain Injection

The version circulating in underground toolkits carries the full W0rm supply-chain injection. A GET parameter handler fires on every HTTP request — pre-auth by default, since the original unzipper has no auth to bypass in the first place. The same xsec/blocker file upload backdoor is present for persistent secondary access.

The unzipper injection includes a C2 beacon with a notable twist. The beacon fetches content from a Pastebin URL, computes the MD5 hash of that content, and constructs a recipient email address as md5(content)@w0rm.com. This means the C2 email address rotates whenever the Pastebin content changes — the operator can redirect exfiltration to a new mailbox without touching any of the deployed backdoors. The beacon sends the compromised server’s URL and installation path to this dynamically constructed address.

The beacon writes a local errors_log file after the first successful exfiltration. On subsequent requests, it checks for this file and skips the beacon if it already exists. Each compromised installation reports home exactly once — reducing noise, avoiding mail rate limits, and making the exfiltration harder to detect through repeated outbound connections. The filename errors_log is chosen to blend in with legitimate PHP error logging.

The poisoned version is functionally identical to the clean one — archives extract correctly, the interface works as expected. The backdoor operates silently alongside the legitimate function. Since unzipper has no authentication to begin with, the W0rm RCE payload does not need to circumvent any access controls — it simply adds shell execution capability to a tool that was already open to the internet.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_unzipper {
    meta:
        description = "Unzipper utility carrying the W0rm supply-chain injection (base64 form; VT 0/62)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/unzipper/"

    strings:
        $title    = "unzipper" ascii nocase
        $ziparch  = "ZipArchive" ascii
        $extract  = "extractTo" ascii
        $w0rm_log    = "errors_log" ascii
        $w0rm_b64pb  = "aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3" ascii
        $w0rm_cmd    = "$_GET[\"cmd\"]" ascii
        $w0rm_pb     = "pastebin.com/raw/" ascii

    condition:
        filesize < 20KB
        and ($title or ($ziparch and $extract))
        and ($w0rm_log or $w0rm_b64pb or $w0rm_cmd or $w0rm_pb)
}

W0rm-infected variants are also caught by the generic W0rm supply-chain rule — see the W0rm supply-chain detection applicable to all infected tools.

MITRE ATT&CK

OHIIHO Threat Research.