Dorifel

Overview

Worm:Win32/Dorifel (also known as Quervar) is a unique hybrid threat that combines the self-replicating capabilities of a network worm with the destructive payload of ransomware (specifically file infection/encryption). Discovered around 2012, it caused significant disruptions, particularly in European enterprise environments.

Understanding Dorifel
To an end-user, a Dorifel infection results in an inability to open critical documents (Word, Excel, etc.), which appear corrupted or are replaced by executable files. For a security analyst, Dorifel is a fast-moving lateral threat. Unlike modern crypto-ransomware that encrypts files in place and demands Bitcoin, Dorifel acts more like a classic virus: it infects the files by appending its own malicious code, effectively encrypting the original content and turning the document itself into a carrier for the worm.

Execution and Lateral Movement Tactics
Dorifel is often dropped as a secondary payload by other malware (like the Citadel banking trojan). Upon execution, it establishes persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key. Its primary function is file infection (`T1486`). It scans local drives and mapped network shares (`T1039`) for specific extensions (e.g., `.doc`, `.xls`, `.pdf`). It encrypts the original file content using RC4, appends its own executable code to the beginning of the file, and changes the file icon to match the original document type (`T1036.004`). When a user double-clicks the 'document' on a network share, the malware executes, infecting their machine, and then decrypts and opens the original document in memory to avoid raising immediate suspicion.

Indicators of Compromise & Impact
The impact is widespread data corruption and massive lateral movement across SMB shares. EDR platforms will flag anomalous file modification events on network shares and processes launching from documents (e.g., `word.exe` spawning a suspicious child process). Network logs will show aggressive scanning of port 445 (SMB/CIFS).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.004: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DORIFEL {
    meta:
        description = "Detects Dorifel (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "dorifel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Dorifel Activity
id: 29c6a0d358d9d924414956fe69fcad3f
status: experimental
description: Detects generic indicators of the dorifel malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*dorifel*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly sever the infected endpoint from the network to halt the worm's lateral movement across SMB shares.
2. Temporarily set all critical network file shares to 'Read-Only' to prevent further file infection and encryption.
3. Utilize specialized Dorifel/Quervar decryption utilities (often provided by major AV vendors) to clean the infected files; do NOT simply delete them, as they contain the original, encrypted data.
4. Deploy a GPO to block the execution of files from `%AppData%`, a common staging directory for the worm.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not blindly delete infected documents; this will permanently destroy the user's data, which can often be recovered using decryption tools.
2. Avoid reconnecting the machine to the network before confirming that all network shares have been fully audited and cleaned.

References & External Analysis

• Search "dorifel" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Pccleaners
• Esprot
• Pwsime
• Genericrxgk
• Tpyn

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/dorifel.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.