viper.php (Viper 1337)

Viper 1337 is not a single tool but an ecosystem of minimal file uploaders — XxX.php, 098.php, pwn.php, and variants — all attributed to the same author. The uploaders are bare-bones PHP scripts: a file input form backed by a raw @copy($_FILES) handler with no authentication, no size limits, and no file-type validation. Any visitor who can reach the URL can upload any file to the server. At 857 bytes, the primary variant (XxX.php) is among the smallest tools in the corpus.

Capabilities

Unauthenticated arbitrary file upload. File input form backed by raw @copy($_FILES) — no authentication, no size limits, no file-type validation. First-stage persistence tool: after initial access, the operator drops a Viper uploader to establish a reliable file-write capability, then uploads larger tools (webshells, config grabbers, privilege escalation scripts). Multiple variants: XxX.php, 098.php, pwn.php. 857 bytes for the primary variant. The author identifies as Viper 1337 across contact channels embedded in the source code, linked to an Algerian-origin scene presence.

Hmei7-Linked Supply-Chain Beacon

Every uploader in the Viper ecosystem carries a secondary payload: a Hmei7-linked mail beacon — a @yandex.com address hidden inside a base64_decode() block wrapped in eval(). When the uploader is accessed, the beacon silently sends the server’s URL and installation path to the hardcoded address. This is not the operator’s infrastructure — it is a supply-chain implant. The operator deploying the uploader is simultaneously reporting their compromised server to a third party.

The Hmei7-linked beacon is consistent across all Viper variants, suggesting either collaboration between the two groups or that the beacon was injected into Viper’s tools during redistribution.

GIF89a MIME Evasion

One variant (pwn.php) prepends the GIF89a magic-byte header to the PHP file itself. This causes naive MIME-type detection (both server-side upload filters and WAF content inspection) to classify the file as a GIF image rather than executable PHP. The technique bypasses upload restrictions that whitelist image types — the file passes the MIME check, gets written to disk, and executes as PHP when requested through the web server.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_viper_uploader {
    meta:
        description = "viper.php uploader with Hmei7 supply-chain beacon (Viper 1337)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/viper/"
        status      = "validated"

    strings:
        $viper_title = "Viper 1337" ascii
        $viper_bot   = "Viper 1337 Bot" ascii
        $gif89a      = "GIF89a" ascii
        $eval_b64    = "eval(base64_decode(" ascii
        $hmei7_b64   = "JHR1anVhbm1haWwgPSAnS2VsdWFyZ2FIbWVpN0B5YW5kZXguY29t" ascii
        $copy_upload = "@copy($_FILES['file']['tmp_name']" ascii
        $upl_button  = "_upl=Upload" ascii

    condition:
        filesize < 2KB
        and ($viper_title or $viper_bot)
        and ($eval_b64 or $hmei7_b64 or $copy_upload or $gif89a or $upl_button)
}

The Hmei7 supply-chain beacon is detected by the generic webshell_hmei7_beacon rule — see Hmei7 beacon detection .

MITRE ATT&CK

OHIIHO Threat Research.