STOP
Aliases: Djvu, KeyPass
- First seen
- 2018-12-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-19 17:57:25
- Profile updated
- 2026-07-07 13:44:35
Context
STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Stop_Auto (yara-rule)
Reports & references
- blackberry.com — Wp Spark State Of Ransomware (report)
- ESET — Eset Threat Report Q22020 (report)
- medium.com — Inside View Of Brazzzersff Infrastructure 89B9188Fd145 (report)
- bleepingcomputer.com — The Week In Ransomware April 1St 2022 I Can Fight With A Keyboard (report)
- intel471.com — Privateloader Malware (report)
- blog.sekoia.io — Privateloader The Loader Of The Prevalent Ruzki Ppi Service (report)
- cloudsek.com — Threat Actors Abuse Ai Generated Youtube Videos To Spread Stealer Malware (report)
- team-cymru.com — Seychelles Seychelles On The C 2 Shore (report)
- cybereason.com — The Hole In The Bucket Attackers Abuse Bitbucket To Deliver An Arsenal Of Malware (report)
- medium.com — Gcleaner Garbage Provider Since 2019 2708E7C87A8A (report)
- any.run — Crackedcantil Breakdown (report)
- gdatasoftware.com — Malware Vaccines (report)
- Kaspersky — 95456 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Stop (report)
- cybergeeks.tech — A Detailed Analysis Of The Stop Djvu Ransomware (report)
- github.com — Ioc List (report)
- drive.google.com — View (report)
- bleepingcomputer.com — Djvu Ransomware Spreading New Tro Variant Through Cracks And Adware Bundles (report)
- Kaspersky — 87412 (report)
- gdata.de — 35391 Finger Weg Von Illegalen Software Downloads (report)
- cybleinc.com — Djvu Malware Of Stop Ransomware Family Back With New Variant (report)
- angle.ankura.com — The Stop Ransomware Variant (report)
- malienist.medium.com — Defendagainst Ransomware Stop C8Cf4116645B (report)
- glyc3rius.github.io — Stop (report)