Xorist is a ransomware family made with a free builder, so the extension, note text and note name vary by build. The default build appends .EnCiPhErEd and drops HOW TO DECRYPT FILES.txt. Other common builds use .73i87A, .p5tkjw and .PoAr2w. Encryption is TEA or XOR with a password shared by every victim of a build. Free decryptors are available from Emsisoft (Xorist decryptor) and Trend Micro (Ransomware Decryptor). It targets Windows PCs. The default note asks for an SMS payment, and a password prompt can limit how many tries the victim gets. No data theft is documented.
File extensions: .Rans-A, VuLiCaPs, ....FIXME-DAMAGEDFILES-NEED-TO-CONTACT-THE-EMAIL- URGENTLY-OR-YOUR-FILES-WILL-BE-PERMANENTLY-DELETED, ....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment, ..txt, .([dungeon]-0_0), .([email protected]), .#, .736, .anonymous, .B-Panther, .B0rn30L0ck3D, .Bl9c98vcvv, .BLOCK, .BoY, .btc-Apt2, .btCry_zip, .C0der_HACK, .cat, .CoV, .CrypBits256PT2, .CRYPTOLOCKER, .CryptPethya, .darkeye, .divinity, .DrWeb, .EnCiPhErEd, .errorwindows, .ert, .exe
Ransom note filenames: HOW TO DECRYPT FILES.txt, КАК РАСШИФРОВАТЬ ФАЙЛЫ.txt, BUILD_INFO.txt, HOW_TO_DECRYPT_FILES.txt, pop-up window
Decryptor: A free decryptor is available.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161