{
  "family": "dorifel",
  "sample_count": 19,
  "category": "trojan",
  "description": "Dorifel (also known as Quervar and classified across antivirus vendors under signatures including Trojan:Win32/Dorifel, Virus:Win32/Dorifel.A, and Worm:Win32/Dorifel) is a landmark polymorphic file infector, worm, and banking downloader first discovered in 2012 targeting European financial and government networks. Propagated via spearphishing emails containing malicious Word documents, network shares, and removable USB drives, Dorifel infects existing Microsoft Office documents (Word .doc and Excel .xls) and executable files. It prepends or encrypts original file content, embedding a malicious loader stub so that opening a legitimate document executes the trojan. Dorifel establishes encrypted communications with remote command-and-control servers, downloading secondary banking trojans such as Citadel and Zeus to capture financial credentials.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Dorifel",
    "Virus:Win32/Dorifel",
    "Worm:Win32/Dorifel",
    "Win32/Quervar",
    "Virus:Win32/Dorifel.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Dorifel (Quervar)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dorifel is a polymorphic file infector and banking downloader that embeds malicious code inside Word and Excel documents."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dorifel infect legitimate files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Word (.doc) and Excel (.xls) files on local and shared drives, prepending an executable loader stub to the original content."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are deployed by Dorifel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It downloads secondary banking trojans including Citadel and Zeus to exfiltrate financial credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dorifel propagate across enterprise networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via spearphishing attachments, writable network file shares, and infected USB storage drives."
      }
    },
    {
      "@type": "Question",
      "name": "What is required to disinfect files infected by Dorifel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Use a specialized antimalware disinfector capable of peeling the injected loader stub from original documents, or restore clean documents from backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1059.003",
    "T1055",
    "T1547.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Dorifel",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Dorifel"
    },
    {
      "name": "Kaspersky Lab - Dorifel (Quervar) Malware Analysis",
      "url": "https://securelist.com/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Worm_Dorifel",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_dorifel"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately disconnect infected hosts from local networks to prevent file infection spread across network shares.",
    "Kill active Dorifel loader processes and quarantine newly created executable stubs.",
    "Remove Run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing to Dorifel.",
    "Deploy specialized file disinfection utilities or restore documents from immutable clean backups.",
    "Block identified C2 IP addresses and exfiltration domains across firewalls and web proxies."
  ],
  "what_to_avoid": [
    "Do not open Word or Excel documents on unverified endpoints without macro execution protections.",
    "Do not simply delete infected documents if user data can be recovered using disinfection tools or backups."
  ],
  "target_industries": [
    "Banking & Financial Institutions",
    "Government Agencies",
    "Commercial Enterprises"
  ],
  "target_geographies": [
    "Europe",
    "Global"
  ],
  "threat_actors": [
    "Cybercriminal Banking Syndicates"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Fraud, Banking Theft & Worm Propagation",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}