Kwampirs

Malware & Tools · Kwampirs

· MalwareS0236 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Kwampirs is a backdoor Trojan used by Orangeworm. Kwampirs has been found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines.(Citation: Symantec Orangeworm April 2018) Kwampirs has multiple technical overlaps with Shamoon based on reverse engineering analysis.(Citation: Cylera Kwampirs 2022)

Tactic Coverage

discovery (13)stealth (5)command and control (2)lateral movement (1)persistence (1)privilege escalation (1)

Used By (1 groups)

G0071Orangeworm

Techniques (22)

T1007System Service Discovery

discovery

T1008Fallback Channels

command and control

T1016System Network Configuration Discovery

discovery

T1018Remote System Discovery

discovery

T1021.002SMB/Windows Admin Shares

lateral movement

T1027.001Binary Padding

stealth

T1027.013Encrypted/Encoded File

References

https://attack.mitre.org/software/S0236 https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia