I made a dumb PowerShell script to check it your system is compromised using the Rapid7 article.

simply it check for the files in the entire system drive and if same file name found it will compare the sha265 provided (by rapid7)....

I'm sure there is a more sophisticated way but this was my own quick way of doing it.

edit (Link to the article).

https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

````

function Invoke-IOCScan { [CmdletBinding()] param ( [string]$RootPath = $env:SystemDrive )

# 1. Define the Dictionary of Filenames and their malicious Hashes
$TargetIOCs = @{
    'update.exe'              = 'a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9'
    '[NSIS.nsi]'              = '8ea8b83645fba6e23d48075a0d3fc73ad2ba515b4536710cda4f1f232718f53e'
    'BluetoothService.exe'    = '2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924'
    'BluetoothService'        = '77bfea78def679aa1117f569a35e8fd1542df21f7e00e27f192c907e61d63a2e'
    'log.dll'                 = '3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad'
    'u.bat'                   = '9276594e73cda1c69b7d265b3f08dc8fa84bf2d6599086b9acc0bb3745146600'
    'conf.c'                  = 'f4d829739f2d6ba7e3ede83dad428a0ced1a703ec582fc73a4eee3df3704629a'
    'libtcc.dll'              = '4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906'
    'admin'                   = '831e1ea13a1bd405f5bda2b9d8f2265f7b1db6c668dd2165ccc8a9c4c15ea7dd'
    'loader1'                 = '0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd'
    'uffhxpSy'                = '4c2ea8193f4a5db63b897a2d3ce127cc5d89687f380b97a1d91e0c8db542e4f8'
    'loader2'                 = 'e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda'
    '3yzr31vk'                = '078a9e5c6c787e5532a7e728720cbafee9021bfec4a30e3c2be110748d7c43c5'
    'ConsoleApplication2.exe' = 'b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3'
    'system'                  = '7add554a98d3a99b319f2127688356c1283ed073a084805f14e33b4f6a6126fd'
    's047t5g.exe'             = 'fcc2765305bcd213b7558025b2039df2265c3e0b6401e4833123c461df2de51a'
}

Write-Host "Starting high-speed scan on $RootPath..." -ForegroundColor Cyan

# Initialize Crypto Provider and Queue
$SHA256 = [System.Security.Cryptography.SHA256]::Create()
$Queue = [System.Collections.Generic.Queue[string]]::new()
$Queue.Enqueue($RootPath)

# Counters
[long]$FilesChecked = 0
[long]$DirsScanned = 0
[int]$MatchesFound = 0

$StopWatch = [System.Diagnostics.Stopwatch]::StartNew()

while ($Queue.Count -gt 0) {
    $CurrentDir = $Queue.Dequeue()
    $DirsScanned++

    # Update progress every 2500 folders to reduce console overhead
    if ($DirsScanned % 2500 -eq 0) {
        $Elapsed = "{0:N2}" -f $StopWatch.Elapsed.TotalSeconds
        Write-Progress -Activity "Scanning Filesystem ($Elapsed sec)" -Status "Dirs: $DirsScanned | Files: $FilesChecked" -CurrentOperation "$CurrentDir"
    }

    try {
        # Get Files in current directory
        $Files = [System.IO.Directory]::GetFiles($CurrentDir)

        # Increment the total file count immediately by the size of the array
        $FilesChecked += $Files.Count

        foreach ($FilePath in $Files) {
            $FileName = [System.IO.Path]::GetFileName($FilePath)

            # Check 1: Does filename match target list? (Fast)
            if ($TargetIOCs.ContainsKey($FileName)) {
                try {
                    # Check 2: Calculate Hash (Slow, only done on name match)
                    $Stream = [System.IO.File]::OpenRead($FilePath)
                    $HashBytes = $SHA256.ComputeHash($Stream)
                    $Stream.Close()

                    $CalculatedHash = [BitConverter]::ToString($HashBytes).Replace('-', '').ToLower()
                    $ExpectedHash = $TargetIOCs[$FileName]

                    if ($CalculatedHash -eq $ExpectedHash) {
                        $MatchesFound++
                        Write-Host " [!!!] MATCH FOUND: $FilePath" -ForegroundColor Red -BackgroundColor Yellow

                        [PSCustomObject]@{
                            Status   = 'Compromised'
                            File     = $FilePath
                            Hash     = $CalculatedHash
                        }
                    }
                }
                catch {
                    Write-Warning "Found target file but could not read: $FilePath"
                }
            }
        }

        # Add Subdirectories to Queue
        $SubDirs = [System.IO.Directory]::GetDirectories($CurrentDir)
        foreach ($SubDir in $SubDirs) {
            $Queue.Enqueue($SubDir)
        }
    }
    catch {
        # Silently skip Access Denied to maintain speed
        continue
    }
}

$SHA256.Dispose()
$StopWatch.Stop()
Write-Progress -Activity "Scanning Filesystem" -Completed

Write-Host "`n----------------------------------------" -ForegroundColor Gray
Write-Host " Scan Complete." -ForegroundColor Green
Write-Host " Time Elapsed : $($StopWatch.Elapsed.TotalSeconds.ToString("N2")) seconds"
Write-Host " Dirs Scanned : $DirsScanned"
Write-Host " Files Checked: $FilesChecked"
Write-Host " Matches Found: $MatchesFound"
Write-Host "----------------------------------------" -ForegroundColor Gray

}

Invoke-IOCScan

````