{
  "family": "xorist",
  "sample_count": 15,
  "category": "ransomware",
  "description": "Xorist (classified across the cybersecurity industry as Ransom:Win32/Xorist, Trojan-Ransom.Win32.Xorist, and Enigma/Xorist builder family) is a landmark, highly configurable ransomware construction kit active since 2010. Developed in Delphi/C++, the Xorist ransomware builder allows novice threat actors to generate customized ransomware binaries with configurable file extension targets, custom ransom note texts, and extortion demands via SMS or cryptocurrency. Xorist encrypts files using symmetric XOR, TEA (Tiny Encryption Algorithm), or AES algorithms, appending custom extensions (such as .xorist, .EnCiPhErEd, or user-defined strings) to encrypted files. Xorist displays a modal lock screen, disables Task Manager, and deletes Volume Shadow Copies. Because early builders used weak XOR keys or deterministic PRNGs, antimalware vendors and Kaspersky developed universal decryption tools for many Xorist variants.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Xorist",
    "Trojan-Ransom.Win32.Xorist",
    "Win32/Xorist",
    "Xorist Ransomware Builder",
    "Trojan-Ransom.Win32.Enigma"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Xorist?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Xorist is a landmark ransomware construction kit that allows attackers to build customized ransomware payloads with custom extensions and ransom notes."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms are used by Xorist variants?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Xorist commonly uses XOR cipher variants, Tiny Encryption Algorithm (TEA), or AES with keys derived from builder configurations."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted by Xorist be decrypted without paying?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, security research firms (including Kaspersky) created free decryption utilities (such as RakhniDecryptor) capable of recovering Xorist-encrypted files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Xorist intimidate victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It locks the screen with non-closable warning dialogs, alters the desktop wallpaper, and disables Task Manager to prevent termination."
      }
    },
    {
      "@type": "Question",
      "name": "How do you recover an infected system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Safe Mode, terminate the Xorist locker process, run an authorized Xorist decryptor tool, and remove persistence registry keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1491",
    "T1490",
    "T1562.001",
    "T1547.001",
    "T1083"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to prevent the ransomware from enumerating and encrypting shared network drives (SMB shares).",
    "Identify the specific variant and extension used; check the 'No More Ransom' project, as decryption tools are freely available for many older Xorist iterations.",
    "Use EDR or Process Explorer to terminate the active encryption process before attempting to clean the Registry Run keys.",
    "If decryption is impossible, restore the affected files from a secure, offline backup after a complete OS rebuild."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; due to the amateur nature of many Xorist operators, paying does not guarantee you will receive a working decryption key.",
    "Avoid restarting the computer if the encryption process is actively running, as this can corrupt files currently being processed."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Xorist",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Xorist"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom.Win32.Xorist Analysis",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Xorist/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}