Xorist ransomware

Xorist is a ransomware family made with a free builder, so the extension, note text and note name vary by build. The default build appends .EnCiPhErEd and drops HOW TO DECRYPT FILES.txt. Other common builds use .73i87A, .p5tkjw and .PoAr2w. Encryption is TEA or XOR with a password shared by every victim of a build. Free decryptors are available from Emsisoft (Xorist decryptor) and Trend Micro (Ransomware Decryptor). It targets Windows PCs. The default note asks for an SMS payment, and a password prompt can limit how many tries the victim gets. No data theft is documented.

Sources: In-house research

File extensions: .Rans-A, ....FIXME-DAMAGEDFILES-NEED-TO-CONTACT-THE-EMAIL- URGENTLY-OR-YOUR-FILES-WILL-BE-PERMANENTLY-DELETED, ....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment, ..txt, .([dungeon]-0_0), .(oplatabtc3[@]gmail[.]com), .#, .736, .anonymous, .B-Panther, .B0rn30L0ck3D, .Bl9c98vcvv, .BLOCK, .BoY, .btc-Apt2, .btCry_zip, .C0der_HACK, .cat, .CoV, .CrypBits256PT2, .CRYPTOLOCKER, .CryptPethya, .darkeye, .divinity, .DrWeb, .EnCiPhErEd, .errorwindows, .ert, .exe, .f0x, .GlUTe, .gold, .Got, .greedyf*ckers, .hacker crypt2020[.]data, .hjutm, .HOW TO DECRYPT FILES.txt, .huis_bn, .hyj, .keygroup or .keygroup777, .KoRyA, .L00KUPRU, .LOCKED, .locked3dllkierff, .LOCKFILE, .lUUUUUUUUU, .LyDark, .MailRU, .Mal, .matafaka, .medusabtc, .Microsoft, .miK, .monero, .motion, .NIGG3R, .nigger, .omfl, .Pay, .pEaKyBlNdEr, .PrO, .PrOToN, .pwned, .QolkuzNbVcG, .Ransomware KillDisk 2017 zaplat, .RaZiO, .remember_you_have_only_50_hours_to_make_the_payment_or_we_will_delete_your_decryptor_from_our_base, .report, .rtg, .Sal13, .saw, .snopy, .ssghl, .strip4you, .system_damaged_payment_must_be_done_ in_maxim_24_hours_or_your_encryption_key_will_ be_deleted_forver_this_is_no_jock, .TAKA, .th, .TiNx, .TMRCRYPT0R, .trg, .VaPo, .vzlom, .Wagner2.0, .WanaCray2023+, .wannacry666, .WiKoN, .XiN, .Xorist, .xqwertzuioplkjhgfyxcvbnmD, .YaKo, .ZaCaPa, .ZaLtOn, .zasifrovano zaplat, .Zasifrovano[.]zaplat[.]za klic 2021, .ZaToN, .ZeNyA, .ZeRy, .zipp3rs, .ZoLiSoNaL, .ZoN, 1.jpg.f**ck3dup, Boom, ety, flubo, locks, Notwanna, raped, VuLiCaPs

Ransom note filenames: HOW TO DECRYPT FILES.txt, КАК РАСШИФРОВАТЬ ФАЙЛЫ.txt, BUILD_INFO.txt, HOW_TO_DECRYPT_FILES.txt

Contact addresses: mollyrecup[@]protonmail[.]com, msy85689[@]rambler[.]ru, 1413201760[@]qq[.]com, alix1011[@]protonmail[.]com, andrey09313[@]mail[.]ru, annait578[@]yandex[.]ru, anon_bot666[@]protonmail[.]com, auditorbit256[@]protonmail[.]com, avastvirusinfo[@]yandex[.]ru, believerop[@]secmail[.]pro, blymer[@]xyzmailpro[.]com, boyka[@]tuta[.]io, btcontact[@]protonmail[.]com, btcpaynow[@]protonmail[.]com, bufalo[@]boximail[.]com, buildvirusbot[@]yandex[.]ru, C0dhakcer[@]mail[.]ru, codiv2021[@]tutanota[.]com, covina[@]tuta[.]io, covina1[@]skiff[.]com, Cryptoware12[@]protonmail[.]com, dalepotts445889[@]gmail[.]com, dec[@]ro[.]ru, desm4578[@]rambler[.]ru, dntcrypt[@]protonmail[.]com, elanor35runte35[@]myrambler[.]ru, Email_Decryptor_Payment[@]scryptmail[.]com, frankhans[@]tuta[.]io, glutezon[@]gmx[.]com, golden03770pirate7[@]ccmail[.]uk, goldenapple120pere[@]gmail[.]com, goodlucky[@]contractor[.]net, gotis[@]onionmail[.]org, gotis[@]tuta[.]io, imbun6[@]gmail[.]com, ineedmoney12[@]tutanota[.]com, johnpeakbtc[@]protonmail[.]com, kil4tx[@]secmail[.]pro, koeserg[@]gmail[.]com, korya[@]tuta[.]io, lUUUUUUUUUUbasq[@]mail[.]ru, malcoi[@]tuta[.]io, mayakovsky[@]activist[.]com, mcrypt2019[@]yandex[.]com, medusabtc[@]protonmail[.]com, mrborneo404[@]gmail[.]com, mujkontakt[@]protonmail[.]com, niggapoopoo123[@]protonmail[.]com, nikminch[@]bk[.]ru, oleg8581[@]mail[.]ru, ooosk-ural[@]yandex[.]ru, pasomnicadecryption[@]gmail[.]com, pert[.]desifruj[.]data[@]protonmail[.]com, protix[@]skiff[.]com, protix[@]tuta[.]io, protonis2023[@]tuta[.]io, raziotix[@]tuta[.]io, recoverybpanther[@]proton[.]me, resk94043[@]rambler[.]ru, service_windows[@]scryptmail[.]com, sotiksotikovich[@]gmail[.]com, supportforyou[@]msgsafe[.]io, system_stop2020[@]tutanota[.]co, t1503[@]bk[.]ru, tenagliamirella[@]gmail[.]com, tinxony[@]protonmail[.]com, unlockmen[@]excite[.]com, usoslus[@]mailfence[.]com, v7991215[@]gmail[.]com, vapotin[@]tuta[.]io, viruszone4209[@]opentrash[.]com, vulicapson[@]cock[.]lu, vulicapson[@]tuta[.]io, wikon[@]tuta[.]io, xinoz[@]cock[.]li, yakomoko[@]protonmail[.]com, zacapa[@]cock[.]li, zalton[@]tuta[.]io, zaronis[@]gmx[.]com, zaton[@]tuta[.]io, zenya[@]tuta[.]io, zery[@]tuta[.]io, zonix[@]cock[.]li

Payment wallets: bc1qygn239pmpswtge00x60ultpp6wymht64ggf5mk, 12et3ym4PnDzc9L5AfXyJz7bTfb8zvc8Hn, bc1q0u997r79ylv9hrc7zcth0mvr3mjua6324hxnkc, bc1q6x4kev9pefay37uctaq9ggqmxrg7a6txn2tanf, bc1q73lm30rgv6h9wy42y88t0r8prjh9l9pzpvvm9c, bc1q8k2z7u5s9mx0jzcvtfmawg33drhuev5dj6uds7, bc1qer6g9j7h8ee4ea8x6xl2058td4qan565k5jq06, bc1quvt7psemyfpqqq2aacrjght84x393e40xlaewu, bc1qvxl7lc9kehsh3y3m2aatekpyjs8pd2zx3j34dx

Decryptor: A decryptor exists but covers only some builds. Checked 2026-11-05.

Scope: Partial: Emsisoft's Xorist family decryptor. Needs a matching pair: one encrypted file of at least 144 bytes and its unencrypted original. Victims with no original copy of any encrypted file, and builds the tool does not recognise, are not covered.

Data exfiltration risk: Low — Xorist is a highly customisable ransomware builder used by many actors; it performs local XOR-based encryption without exfiltration. Actors set arbitrary custom extensions.

Systems typically targeted: User documents, media and mapped network folders on Windows.

Do this first: Disconnect the host, then run the free Emsisoft Xorist decrypter.

From the ransom note HOW TO DECRYPT FILES.txt:

Todos Dados/Backups foram criptografados a unica forma de obter os dados em seu perfeito estado? entrar em contato no Email: mollyrecup[@]protonmail[.]com Dados em perfeito estado em at? 1 hora prazo max para o contato 20/03/2023 12:00 ID-6732 (N = N?O) - N delete arquivos trancados - N n?o renomeie os arquivos trancados .Rans-A - N n?o poste esta mensagem em nenhum site […]

Link to decryptor: Emsisoft