{
  "family": "dorifel",
  "sample_count": 19,
  "category": "ransomware",
  "description": "Worm:Win32/Dorifel (also known as Quervar) is a unique hybrid threat that combines the self-replicating capabilities of a network worm with the destructive payload of ransomware (specifically file infection/encryption). Discovered around 2012, it caused significant disruptions, particularly in European enterprise environments.<br><br><b>Understanding Dorifel</b><br>To an end-user, a Dorifel infection results in an inability to open critical documents (Word, Excel, etc.), which appear corrupted or are replaced by executable files. For a security analyst, Dorifel is a fast-moving lateral threat. Unlike modern crypto-ransomware that encrypts files in place and demands Bitcoin, Dorifel acts more like a classic virus: it infects the files by appending its own malicious code, effectively encrypting the original content and turning the document itself into a carrier for the worm.<br><br><b>Execution and Lateral Movement Tactics</b><br>Dorifel is often dropped as a secondary payload by other malware (like the Citadel banking trojan). Upon execution, it establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key. Its primary function is file infection (`T1486`). It scans local drives and mapped network shares (`T1039`) for specific extensions (e.g., `.doc`, `.xls`, `.pdf`). It encrypts the original file content using RC4, appends its own executable code to the beginning of the file, and changes the file icon to match the original document type (`T1036.004`). When a user double-clicks the 'document' on a network share, the malware executes, infecting their machine, and then decrypts and opens the original document in memory to avoid raising immediate suspicion.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is widespread data corruption and massive lateral movement across SMB shares. EDR platforms will flag anomalous file modification events on network shares and processes launching from documents (e.g., `word.exe` spawning a suspicious child process). Network logs will show aggressive scanning of port 445 (SMB/CIFS).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1486",
    "T1039",
    "T1036.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1039",
      "name": "Data from Network Shared Drive",
      "tactic": "Collection"
    },
    {
      "id": "T1036.004",
      "name": "Masquerading: Masquerade Task or Service",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoint from the network to halt the worm's lateral movement across SMB shares.",
    "Temporarily set all critical network file shares to 'Read-Only' to prevent further file infection and encryption.",
    "Utilize specialized Dorifel/Quervar decryption utilities (often provided by major AV vendors) to clean the infected files; do NOT simply delete them, as they contain the original, encrypted data.",
    "Deploy a GPO to block the execution of files from `%AppData%`, a common staging directory for the worm."
  ],
  "what_to_avoid": [
    "Do not blindly delete infected documents; this will permanently destroy the user's data, which can often be recovered using decryption tools.",
    "Avoid reconnecting the machine to the network before confirming that all network shares have been fully audited and cleaned."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}