Mario2045

decrypt_Xorist.exe can't generate key

Recommended Posts

When dropping both files encrypted and not encrypted I'm getting the following message:

"The decrypter could not determine a valid key for your system. Please drag and drop both an encrypted file as well as its unencrypted counterpart onto the decrypter to determine the correct key. Files need to be at least 510 bytes long."

I've already used the ID Ransomware web site to identify the ransonware as Xorist, the extension of encrypted files is *.EnCiPhErEd.

Any ideas why does the software is not working?

Share this post


Link to post
Share on other sites

More than likely either one of the files you're using for your file pair is corrupt/damaged, or the ransomware is being mistakenly identified as Xorist.

That being said, the extension does match a known extension for Xorist:
https://www.bleepingcomputer.com/forums/t/608564/xorist-enciphered-ransomware-support-and-help-topic-how-to-decrypt-filestxt/
https://www.bleepingcomputer.com/news/security/emsisoft-releases-decryptors-for-the-xorist-and-777-ransomware/

Share this post


Link to post
Share on other sites

If you are unable to provide the decrypter with a valid encrypted/original file pair, then an alternative would be to supply an encrypted Office document. The user @thyrex on the BleepingComputer forums is able to manually derive a key in some cases that is compatible with the Emsisoft decrypter. There's also the possibility of multiple layers of encryption on the files, in which case only manual review will possibly work.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.