malware family

Xorist

unknownentity:malware_familyransomware · 1 source

Ransomware encrypted files will still have the original non-encrypted header of 0x33 bytes length

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: xorist
kind: malware family
status: unknown
aliases: —
jurisdictions: —
claims naming it: 16 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy 0a15a920-9876-4985-9d3d-bb0794722258via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 16 of 16

Xoristransomwarepayment
subjecttransactiona39a2b6c8a…431570fa54
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1B8G2L24xbn1sDbPurUNGMXwZWFgVXuYQv · 2,404,424 sat · time 2017-09-08 21:47 UTC · url https://ransomwhe.re/#address/1B8G2L24xbn1sDbPurUNGMXwZWFgVXuYQv
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24840btcintel:annotations:24840@v3 sha256:f831d72b76994151
confidencetrusted provider · 50
Xoristransomwarepayment address
subjectaddress1B8G2L24xbn1sDbPurUNGMXwZWFgVXuYQv
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Xorist · url https://ransomwhe.re/#address/1B8G2L24xbn1sDbPurUNGMXwZWFgVXuYQv
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_24839btcintel:annotations:24839@v2 sha256:2a21852f2a35b4c4
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransactionb5ff74f00e…ce3b74e763
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK · 100,000,000 sat · time 2017-06-06 06:49 UTC · url https://ransomwhe.re/#address/1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24766btcintel:annotations:24766@v3 sha256:a79948d2f3a43164
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransaction32687bb756…51aab5fe9d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK · 6,900,000 sat · time 2017-06-06 06:51 UTC · url https://ransomwhe.re/#address/1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24765btcintel:annotations:24765@v3 sha256:c0ea591e5b3e6ac5
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransaction6727a76057…996631199b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK · 200,000 sat · time 2017-06-06 09:41 UTC · url https://ransomwhe.re/#address/1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24764btcintel:annotations:24764@v3 sha256:12134c8f6e54876f
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransaction20a03a7f44…3bbc7055a9
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK · 4,685,000 sat · time 2017-06-06 23:14 UTC · url https://ransomwhe.re/#address/1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24763btcintel:annotations:24763@v3 sha256:a2e95f8899a0d59e
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransactiond5aca49ad6…daf532c34f
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK · 35,570,000 sat · time 2017-06-07 22:09 UTC · url https://ransomwhe.re/#address/1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24762btcintel:annotations:24762@v3 sha256:766c367eb209a76b
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransactiond881b179f7…f2055c8cd2
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK · 17,780,000 sat · time 2017-06-09 11:43 UTC · url https://ransomwhe.re/#address/1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24761btcintel:annotations:24761@v3 sha256:bf59d610cdb9a954
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransactionbb2002e684…9260e99006
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK · 9,602,550 sat · time 2017-06-10 09:00 UTC · url https://ransomwhe.re/#address/1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24760btcintel:annotations:24760@v3 sha256:05bedc8ac2f79b0a
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransaction7f427c1c94…98fc247c8d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK · 200,000,000 sat · time 2017-07-08 07:42 UTC · url https://ransomwhe.re/#address/1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24759btcintel:annotations:24759@v3 sha256:2496306aca0a30c2
confidencetrusted provider · 50
Xoristransomwarepayment address
subjectaddress1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Xorist · url https://ransomwhe.re/#address/1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_24758btcintel:annotations:24758@v2 sha256:5738a6a2bff2620c
confidencetrusted provider · 50
Xoristransomwarepayment address
subjectaddress3FQyoeHS3ECatjxf7ePo4qNMkwtn8qMLqD
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Xorist · url https://ransomwhe.re/#address/3FQyoeHS3ECatjxf7ePo4qNMkwtn8qMLqD
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_24001btcintel:annotations:24001@v2 sha256:8ff66154ec66d594
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransaction2a73ec11ff…acff0bbe53
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Jx89PqW8nUARMabarDc86Qc3NfsUgH6q3 · 10,228,262 sat · time 2017-05-26 22:03 UTC · url https://ransomwhe.re/#address/1Jx89PqW8nUARMabarDc86Qc3NfsUgH6q3
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24000btcintel:annotations:24000@v3 sha256:6404426b9bfd9904
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransactionc017409653…9f623286a7
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Jx89PqW8nUARMabarDc86Qc3NfsUgH6q3 · 12,380,284 sat · time 2017-06-17 18:25 UTC · url https://ransomwhe.re/#address/1Jx89PqW8nUARMabarDc86Qc3NfsUgH6q3
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23999btcintel:annotations:23999@v3 sha256:233070c12e14be0a
confidencetrusted provider · 50
Xoristransomwarepayment
subjecttransaction3bca3708d1…6c066bfef7
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Jx89PqW8nUARMabarDc86Qc3NfsUgH6q3 · 19,771,129 sat · time 2017-06-28 10:13 UTC · url https://ransomwhe.re/#address/1Jx89PqW8nUARMabarDc86Qc3NfsUgH6q3
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23998btcintel:annotations:23998@v3 sha256:cfc6bac2e58c3afc
confidencetrusted provider · 50
Xoristransomwarepayment address
subjectaddress1Jx89PqW8nUARMabarDc86Qc3NfsUgH6q3
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Xorist · url https://ransomwhe.re/#address/1Jx89PqW8nUARMabarDc86Qc3NfsUgH6q3
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_23997btcintel:annotations:23997@v2 sha256:4bec21202394241b
confidencetrusted provider · 50

Subjects16 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.