{
  "family": "xorist",
  "sample_count": 15,
  "category": "ransomware",
  "description": "Ransomware:Win32/Xorist (also known as Encoder.Xorist) is a widely distributed, highly customizable Ransomware-as-a-Service (RaaS) builder. First appearing around 2010, the Xorist 'builder' utility allows even low-skill cybercriminals (script kiddies) to generate their own custom ransomware payloads by selecting the file extensions to encrypt, the encryption algorithm, the ransom note text, and the background image.<br><br><b>Understanding Xorist Ransomware</b><br>To a victim, a Xorist infection results in the rapid encryption of their personal documents, images, and databases. The desktop background is typically replaced with a custom ransom note, and encrypted files often bear a unique extension chosen by the attacker (e.g., `.EnCiPhErEd`, `.0x0145`, or a random string). For a security analyst, Xorist is notable for its simplicity. Unlike modern, advanced ransomware (like LockBit), older Xorist variants often utilized a relatively weak, custom XOR-based encryption algorithm (hence the name), making them susceptible to brute-force decryption.<br><br><b>Execution and Extortion Mechanics</b><br>Xorist payloads are typically distributed via spam emails, fake software cracks, or adware networks (`T1189`). Upon execution, the payload establishes persistence via the Registry Run keys (`T1547.001`). It then rapidly iterates through the file system, searching for the targeted file extensions (`T1083`). It encrypts these files (`T1486`) and drops a text or HTML ransom note in every affected directory. Advanced variants may attempt to delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to inhibit system recovery (`T1490`), though early versions often lacked this capability.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate data unavailability and extortion. EDR platforms will alert on rapid, massive file modification events across user directories, often accompanied by the execution of `vssadmin.exe`. The presence of a newly set desktop wallpaper (the ransom note) and files appended with unusual extensions are definitive IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1491",
    "T1490",
    "T1547.001",
    "T1486",
    "T1083"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to prevent the ransomware from enumerating and encrypting shared network drives (SMB shares).",
    "Identify the specific variant and extension used; check the 'No More Ransom' project, as decryption tools are freely available for many older Xorist iterations.",
    "Use EDR or Process Explorer to terminate the active encryption process before attempting to clean the Registry Run keys.",
    "If decryption is impossible, restore the affected files from a secure, offline backup after a complete OS rebuild."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; due to the amateur nature of many Xorist operators, paying does not guarantee you will receive a working decryption key.",
    "Avoid restarting the computer if the encryption process is actively running, as this can corrupt files currently being processed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}