Orangeworm Kwampirs Trojan Detection

The script tries to detect the Orangeworm Kwampirs Trojan via various known Indicators of Compromise (IOC).

The Orangeworm group is using a repurposed Trojan called Kwampirs to set up persistent remote access after they infiltrate victim organizations. Kwampirs is not especially stealthy and can be detected using indicators of compromise and activity on the target system. The Trojan evades hash-based detection by inserting a random string in its main executable so its hash is different on each system. However, Kwampirs uses consistent services names, configuration files, and similar payload DLLs on the target machine that can be used to detect it.

All Windows Systems.

A whole cleanup of the infected system is recommended.