Dorifel: Difference between revisions

Revision as of 11:30, 31 July 2015

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Dorifel
Alias	XDocCrypt
Group	Trojan
Parent
Sibling
Family
Relations	Variants: Sibling of: Prinimalka Parent of: Distribution of: Campaigns:
Target	Netherlands
Origin
Distribution vector	Citadel
UserAgent	Unknown
CCProtocol	HTTP (Centralized)
Activity	2012 / Unknown
Status	Unknown
Language
Programming language
Operation/Working group

	Author	Editor	Year
De code van Dorifel nader bekeken	Brenno de Winter	IDG	2012
Dorifel crypto malware paralyzes Dutch companies and public sector		Emsisoft	2012
Dorifel is much bigger than expected and it’s still active and growing!	David Jacoby	Kaspersky lab	2012
Dorifel virus gereed voor Nederlandse banking phishing	Huub Roem	Digital Investigation	2012
Dorifel/Quervar: the support scammer’s secret weapon	David Harley	ESET	2012
Joint strike force against Dorifel		SurfRight	2012
More details of the Dorifel servers	Rickey Gevers	Rickey Gevers	2012
Quervar – Induc.C reincarnate	Robert Lipovsky	Eset	2012

@@ Line 1: / Line 1: @@
 {{Botnet
+|Alias=XDocCrypt,
 |Target=Netherlands,
 |Vector=Citadel,
 |UserAgent=Unknown
-|CCProtocol=Unknown
+|CCProtocol=HTTP,
+|Feature=Worm, Encrypt files,
 |Status=Unknown
 |BeginYear=2012
 |EndYear=Unknown
+|Group=Trojan,
 |Fonctionnalités=* [[feature::Encrypt files]] Word & Excel (clé RC4: 0D 0A 05 0F 59 38 5A 5B 7B 36 7E 0D 31 69 0D 09)
 |Illustrations=