"Whom" is the objective form, used with objects (direct object, indirect object, object of the preposition, etc.) while "who" is the subjective/nominative form.
Thus, "Who are you?" Is correct because "who" acts as the predicate nominative. But "Whom did you kill?" (Not "who did you kill.") Is correct because the interrogative pronoun acts as the object, viz. You did kill WHOM (replaces the object, like panda/gorilla/my neighbor/etc.).