MITRE ATT&CKsoftware (malware)
S0236 Kwampirs
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.2
- Created
- 2018-10-17
Description
Kwampirs is a backdoor Trojan used by Orangeworm. Kwampirs has been found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines. Kwampirs has multiple technical overlaps with Shamoon based on reverse engineering analysis.
Related
Uses · MITRE ATT&CK (22)
- T1027.013 Encrypted/Encoded File sub-technique
- T1069.001 Local Groups sub-technique
- T1069.002 Domain Groups sub-technique
- T1087.001 Local Account sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1027.001 Binary Padding sub-technique
- T1218.011 Rundll32 sub-technique
- T1543.003 Windows Service sub-technique
- T1201 Password Policy Discovery technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1007 System Service Discovery technique
- T1008 Fallback Channels technique
- T1016 System Network Configuration Discovery technique
- T1018 Remote System Discovery technique
- T1033 System Owner/User Discovery technique
- T1049 System Network Connections Discovery technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G0071 Orangeworm group
References
- https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf Cylera Kwampirs 2022
- https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia Symantec Orangeworm April 2018