Xorist

Overview

Ransomware:Win32/Xorist (also known as Encoder.Xorist) is a widely distributed, highly customizable Ransomware-as-a-Service (RaaS) builder. First appearing around 2010, the Xorist 'builder' utility allows even low-skill cybercriminals (script kiddies) to generate their own custom ransomware payloads by selecting the file extensions to encrypt, the encryption algorithm, the ransom note text, and the background image.

Understanding Xorist Ransomware
To a victim, a Xorist infection results in the rapid encryption of their personal documents, images, and databases. The desktop background is typically replaced with a custom ransom note, and encrypted files often bear a unique extension chosen by the attacker (e.g., `.EnCiPhErEd`, `.0x0145`, or a random string). For a security analyst, Xorist is notable for its simplicity. Unlike modern, advanced ransomware (like LockBit), older Xorist variants often utilized a relatively weak, custom XOR-based encryption algorithm (hence the name), making them susceptible to brute-force decryption.

Execution and Extortion Mechanics
Xorist payloads are typically distributed via spam emails, fake software cracks, or adware networks (`T1189`). Upon execution, the payload establishes persistence via the Registry Run keys (`T1547.001`). It then rapidly iterates through the file system, searching for the targeted file extensions (`T1083`). It encrypts these files (`T1486`) and drops a text or HTML ransom note in every affected directory. Advanced variants may attempt to delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to inhibit system recovery (`T1490`), though early versions often lacked this capability.

Indicators of Compromise & Impact
The impact is immediate data unavailability and extortion. EDR platforms will alert on rapid, massive file modification events across user directories, often accompanied by the execution of `vssadmin.exe`. The presence of a newly set desktop wallpaper (the ransom note) and files appended with unusual extensions are definitive IoCs.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_XORIST {
    meta:
        description = "Detects Xorist (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "xorist" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Xorist Activity
id: 093bcdc1472ab7b09fc81a41d13a7899
status: experimental
description: Detects generic indicators of the xorist malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*xorist*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to prevent the ransomware from enumerating and encrypting shared network drives (SMB shares).
2. Identify the specific variant and extension used; check the 'No More Ransom' project, as decryption tools are freely available for many older Xorist iterations.
3. Use EDR or Process Explorer to terminate the active encryption process before attempting to clean the Registry Run keys.
4. If decryption is impossible, restore the affected files from a secure, offline backup after a complete OS rebuild.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not pay the ransom; due to the amateur nature of many Xorist operators, paying does not guarantee you will receive a working decryption key.
2. Avoid restarting the computer if the encryption process is actively running, as this can corrupt files currently being processed.

References & External Analysis

• Search "xorist" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Purgen
• Wgapatch
• Betkrypt
• Zurgop
• Vbcryptor

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/xorist.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.