An XTBL file is a file encrypted by .xtbl ransomware (also known as the Troldesh trojan), a virus used by cybercriminals to hijack a user's computer files until the user pays the criminal. It contains a user's personal file, such as a .PDF, .XLSX, or .RAW file. XTBL files are encrypted with AES-265 and RSA methods.

The .xtbl virus is dangerous malware that is often referred to as ransomware, where the purpose of the virus is to take your files hostage and force you to pay bitcoins to the perpetrator in order to decrypt your files. The virus can attack your computer in various ways, including email spam with infected attachments or malicious links or fraudulent software updates. Once the virus affects your computer it begins scrambling your files, renaming them with random characters, and encrypting them as XTBL files. When encrypting your files, the .xtbl virus creates README.txt files that contain information about your encrypted files and instructions for decrypting them, which includes how to pay the criminals. These files are placed in each folder that contains XTBL files. If you backup your files you can execute a full system restore. Otherwise, if you do choose to pay the perpetrators, beware that you may be scammed and still left with encrypted files. NOTE: XTBL files are similar to .CERBER, .CERBER2, .LOCKY, and .ZZZZZ files which are all created by ransomware. Many of these files became prevalent in 2016 when the .xtbl, Cerber, and Locky viruses began infecting computers.