Skip to content

Malware

Kwampirs

Kwampirs is a family of malware which uses SMB to spread.

Kwampirs is a Windows malware family operated by Orangeworm.

Background

Kwampirs propagates via SMB and generally refrains from running or deploying where no publicly reachable admin$ share exists. It is a fully featured backdoor capable of fetching additional modules, and its command-and-control normally rides over HTTP, embedding "q=[ENCRYPTED DATA]" within the URI.


Source: Malpedia (Fraunhofer FKIE).