Xorist variant ransomware-affected file
File type: Ransomware encrypted file
Files with the antihacker2017 file extension are encrypted and renamed files affected by a variant of Xorist ransomware.
The extension does not identify a normal user-created file format. It marks files whose contents were encrypted by the ransomware.
File type category:
Ransomware encrypted file
Date updated: October 12, 2026
The antihacker2017 file extension is associated with a variant of the Xorist ransomware family. This malware encrypts users' files and demands a ransom, reportedly in bitcoins, in exchange for restoring access.
An affected file contains the user's original data in encrypted form, with .antihacker2017 added to its name. The extension is therefore part of the ransomware's file-renaming behavior rather than a format used by a separate application.
Emsisoft Decrypter for Xorist is available for Microsoft Windows and is intended to recover files affected by supported Xorist variants.
These files cannot normally be opened in their original applications while they remain encrypted. On Microsoft Windows, use Emsisoft Decrypter for Xorist to attempt to decrypt the .antihacker2017 files.
After successful decryption, remove the ransomware-added extension if necessary and open the recovered file with the application associated with its original file type.
The .antihacker2017 files cannot be meaningfully converted while they are encrypted. Decrypt them first with Emsisoft Decrypter for Xorist.
Once recovered, the files can be saved or exported to another format using the application that normally opens their original file type.
Software apps that recover antihacker2017 files:
Microsoft Windows
Language
