View source for Dorifel/Quervar: the support scammer’s secret weapon

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://blog.eset.com/2012/08/11/dorifelquervar-the-support-scammers-secret-weapon blog.eset.com
|Author=David Harley, 
|NomRevue=ESET Threat Blog
|Date=13 aug2012
|Editor=ESET
|Year=2012
|ISBN=
|Page=
|Abstract=The malware that some people are calling Dorifel or XDocCrypt (ESET detects it as Win32/Quervar.C and has a cleaner for it here) is having enormous impact right now, mostly in the Netherlands. It has some very interesting characteristics – it infects documents (and true executables) by appending them RC4-encrypted to the body of a new executable – and there’ll be a  technical analysis by Róbert Lipovský here shortly.

However, apart from its intrinsic technical interest, it seems that it’s being used for scamming purposes that even its authors may not have anticipated. Martijn Grooten, of Virus Bulletin, tells me that it has attracted the attention of telephone support scammers, who are using it to convince potential victims in the Netherlands that they need to let the scammer ‘clean’ or ‘protect’ their systems. For a price, as always…
|Botnet=Dorifel, XDocCrypt, Quervar, 
|Malware=, 
|CCProtocol=, 
|Operation=, 
|Keyword=, 
}}