- Home
Detectable Ransomware Xorist-Frozen
Ransomware Research
Xorist-Frozen Ransomware
Xorist-Frozen is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on March 1, 2018, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- Xorist-Frozen
- First Seen
- March 1, 2018
How Xorist-Frozen Ransomware Works
Targeted Files
https://app.any.run/tasks/d2da63e6-1334-4ae4-a676-c9cb9a31b4c7/ Encrypts 1812 kb Skips 24 bytes header
File Encryption Patterns
Xorist-Frozen modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
....Files-Frozen-NEED-TO-MAKE-PAYMENT-FOR-DECRYPTOR-OR-ALL-YOUR-FILES-WILL-BE-PERMANENLTY-DELETED
..PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment
........PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment
.....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT
....DATA_IS_SAFE_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_LOST_FOREVER_PLEASE_BE_REZONABLE_IS_NOT_A_JOKE_TIME_IS_LIMITED
.....VeraCrypt_System_Error2019-You_need_to_make_payment_in_maxmin_24_hours_if_you_dont_the_decryptor_license_will_be_deleted_this_is_not_a_joke
..system_damaged_payment_must_be_done_in_maxim_24_hours_or_your_encryption_key_will_be_deleted_forver
Ransom Note and Payment Demands
After encrypting files, Xorist-Frozen displays ransom notes demanding payment for file recovery:
HOW TO DECRYPT FILES.txt
Ransom message:
notes/HOW TO DECRYPT FILES.txt
Note locations:
EveryFolder
Technical Indicators
Associated Executable Files
The following executable files are associated with Xorist-Frozen ransomware:
Xorist-Frozen.exe
gacugefb.exe
02130ye0T5GMhu3.exe
worker.bin
worker.ex_v
myfile.exe
02130ye0t5gmhu3.exe
worker.exe
02130ye0T5GMhu3.exe.3.dr
invoice.exe.1.dr
FOFiUm3GWkYAhYfBMi
02130YE0T5GMHU3.EXE
2018-05-08-Xorist-ransomware-message-popup.exe
yw9rFERMcLTp2PS.exe
x-patch-42311.exe
2018-05-08-Ransomware. Xorist.exess
yw9rfermcltp2ps.exe
ransomware.exe
TempcNH67.eXe
decryptor.exe
2018-05-08-scrypt-ransomware-message-popup.exe
xo.exe
work.exe
Elastio Can Help You
Don't let Xorist-Frozen ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Xorist-Frozen ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Xorist-Frozen.
Last updated: July 30, 2025