Categories: RansomTrojan

TrojanRansom.Xorist information

The TrojanRansom.Xorist is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanRansom.Xorist virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Exhibits possible ransomware file modification behavior
CAPE detected the Xorist malware family
Clears web history

How to determine TrojanRansom.Xorist?


File Info:
name: 5EF11856EF3CA03F2D2C.mlwpath: /opt/CAPEv2/storage/binaries/a5fa5e74f6cf2cec2fdb9e72c4e48e5503bf1c95f8708a3a8d3f38ab45844d1bcrc32: C948D892md5: 5ef11856ef3ca03f2d2c35456d37de35sha1: 8bc02dda6717d62df11635e17e4a7c908a3606c0sha256: a5fa5e74f6cf2cec2fdb9e72c4e48e5503bf1c95f8708a3a8d3f38ab45844d1bsha512: 0556bf5771a894ba3df2d66d2de47faf10753c9698f37ac747c0c74bf37c1ba283d97236347e1070733437e5804621e0417b9200ecffaa878053d30178b4f04dssdeep: 96:11Zhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExtCm82B8cQDyPnQaXt40:Tzdrr1FG1WDCgmjPZtA2cyPQE4MUAtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T18DE16D5B656750EBC0A35231034FC35371BF709117E086A5EA7CAFAA6857850AD36A14sha3_384: 363ffd389b5713ed62f8e4594c117de3f6678556b9e10736c90b8d7bdae479e787fc0e826e97a552cd71beb9dda688e2ep_bytes: 60be159040008dbeeb7fffff57eb0b90timestamp: 2012-01-29 18:49:03
Version Info:
0: [No Data]

TrojanRansom.Xorist also known as:

Lionic	Trojan.Win32.Xorist.lxle
MicroWorld-eScan	Trojan.Ransom.AIG
ClamAV	Win.Trojan.CryptoTorLocker2015-1
FireEye	Generic.mg.5ef11856ef3ca03f
CAT-QuickHeal	Trojan.Ransom.FO4
McAfee	GenericRXAA-AA!5EF11856EF3C
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Ransomware ( 005451b81 )
Alibaba	virus:Win32/InfectPE.ali2000007
K7GW	Ransomware ( 005451b81 )
Cybereason	malicious.6ef3ca
BitDefenderTheta	Gen:NN.ZexaF.34646.amGfaW6kU6ci
Cyren	W32/Filecoder.Y.gen!Eldorado
Symantec	Ransom.CryptoTorLocker
Elastic	malicious (moderate confidence)
ESET-NOD32	Win32/Filecoder.Q
Baidu	Win32.Trojan.Filecoder.g
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.Xorist.ln
BitDefender	Trojan.Ransom.AIG
NANO-Antivirus	Trojan.Win32.Xorist.dxuuhl
Avast	Win32:Evo-gen [Trj]
Tencent	Trojan.Win32.CryptoTorLocker2015.a
Ad-Aware	Trojan.Ransom.AIG
Sophos	ML/PE-A + Troj/Ransom-EY
Comodo	TrojWare.Win32.Kryptik.ER@4o1ar2
DrWeb	Trojan.Encoder.25389
VIPRE	Trojan.Ransom.AIG
TrendMicro	Ransom_XORIST.SMA
McAfee-GW-Edition	BehavesLike.Win32.Generic.zc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.Ransom.AIG (B)
Ikarus	Trojan.Win32.Obfuscated
Jiangmin	Trojan/Xorist.dl
Avira	TR/Ransom.Xorist.EJ
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Generic.ASMalwS.402
Microsoft	Ransom:Win32/Sorikrypt
Arcabit	Trojan.Ransom.AIG
GData	Win32.Trojan-Ransom.Xorist.D
Google	Detected
AhnLab-V3	Trojan/Win32.Xorist.R25524
VBA32	TrojanRansom.Xorist
ALYac	Trojan.Ransom.AIG
TACHYON	Ransom/W32.Xorist.12800
Malwarebytes	Trojan.FileLock
TrendMicro-HouseCall	Ransom_XORIST.SMA
Rising	Ransom.Sorikrypt!8.8822 (TFE:5:H50DeYUdIVS)
Yandex	Trojan.GenAsa!/o0pq2Faa4I
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Xorist.DD8C!tr.ransom
AVG	Win32:Evo-gen [Trj]
Panda	Trj/RansomXor.A
CrowdStrike	win/malicious_confidence_90% (W)