Mario2045

decrypt_Xorist.exe can't generate key

Recommended Posts

When dropping both files encrypted and not encrypted I'm getting the following message:

"The decrypter could not determine a valid key for your system. Please drag and drop both an encrypted file as well as its unencrypted counterpart onto the decrypter to determine the correct key. Files need to be at least 510 bytes long."

I've already used the ID Ransomware web site to identify the ransonware as Xorist, the extension of encrypted files is *.EnCiPhErEd.

Any ideas why does the software is not working?

Share this post


Link to post
Share on other sites

More than likely either one of the files you're using for your file pair is corrupt/damaged, or the ransomware is being mistakenly identified as Xorist.

That being said, the extension does match a known extension for Xorist:
https://www.bleepingcomputer.com/forums/t/608564/xorist-enciphered-ransomware-support-and-help-topic-how-to-decrypt-filestxt/
https://www.bleepingcomputer.com/news/security/emsisoft-releases-decryptors-for-the-xorist-and-777-ransomware/

Share this post


Link to post
Share on other sites

If you are unable to provide the decrypter with a valid encrypted/original file pair, then an alternative would be to supply an encrypted Office document. The user @thyrex on the BleepingComputer forums is able to manually derive a key in some cases that is compatible with the Emsisoft decrypter. There's also the possibility of multiple layers of encryption on the files, in which case only manual review will possibly work.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.