SYMBOLCOMMON_NAMEaka. SYNONYMS
win.stop (Back to overview)

STOP

aka: KeyPass, Djvu
VTCollection    

STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.

References
2024-02-11 ⋅ glyc3rius.github.io ⋅ Glyc3rius
Analysing STOP Ransomware
STOP
2024-01-30 ⋅ ANY.RUN ⋅ Lena (LambdaMamba)
CrackedCantil: A Malware Symphony Breakdown - PrivateLoader, Smoke, Lumma, RedLine, RisePro, Amadey, Stealc, Socks5Systemz, STOP
Amadey CrackedCantil Lumma Stealer PrivateLoader RedLine Stealer RisePro SmokeLoader Socks5 Systemz Stealc STOP
2023-05-26 ⋅ ZAYOTEM ⋅ Emirhan KESKİN
Stop Ransomware
STOP
2023-02-03 ⋅ Cloudsek ⋅ Deepanjli Paulraj, Pavan Karthick M
Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware
Alfonso Stealer Bandit Stealer Cameleon Fabookie Lumma Stealer Nanocore RAT Panda Stealer RecordBreaker RedLine Stealer Stealc STOP Vidar zgRAT
2022-09-29 ⋅ Team Cymru ⋅ S2 Research Team
Seychelles, Seychelles, on the C(2) Shore: An overview of a bulletproof hosting provider named ELITETEAM.
Amadey Raccoon RedLine Stealer SmokeLoader STOP
2022-09-15 ⋅ Sekoia ⋅ Threat & Detection Research Team
PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2022-08-08 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader
2022-04-01 ⋅ Bleeping Computer ⋅ Lawrence Abrams
The Week in Ransomware - April 1st 2022 - 'I can fight with a keyboard'
Hive Dharma LockBit STOP SunCrypt
2022-02-08 ⋅ Intel 471 ⋅ Intel 471
PrivateLoader: The first step in many malware schemes
Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar
2022-01-19 ⋅ Gdata ⋅ Karsten Hahn
Malware vaccines can prevent pandemics, yet are rarely used
Emotet STOP
2021-12-22 ⋅ Ankura ⋅ Vishal Thakur
The ‘STOP’ Ransomware Variant
STOP
2021-12-20 ⋅ Github (vithakur) ⋅ Vishal Thakur
STOP/DJVU Ransomware IOC List
STOP
2021-12-20 ⋅ Vishal Thakur
DefendAgainst: Ransomware ‘STOP’/DJVU
STOP
2021-10-31 ⋅ CYBER GEEKS All Things Infosec ⋅ CyberMasterV
A detailed analysis of the STOP/Djvu Ransomware
STOP
2021-06-21 ⋅ cyble ⋅ cybleinc
DJVU Malware of STOP Ransomware Family Back with New Variant
STOP
2021-01-18 ⋅ Medium csis-techblog ⋅ Benoît Ancel
GCleaner — Garbage Provider Since 2019
Amadey Ficker Stealer Raccoon RedLine Stealer SmokeLoader STOP
2020-07-29 ⋅ ESET Research ⋅ welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2020-02-05 ⋅ Cybereason ⋅ Assaf Dahan, Lior Rochberger
The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware
Amadey Azorult Predator The Thief STOP Vidar
2020-01-01 ⋅ Blackberry ⋅ Blackberry Research
State of Ransomware
Maze MedusaLocker Nefilim Phobos REvil Ryuk STOP
2019-12-11 ⋅ Kaspersky Labs ⋅ Kaspersky
Story of the year 2019: Cities under ransomware siege
Scarab Ransomware STOP
2019-11-21 ⋅ G Data ⋅ Karsten Hahn, Stefan Karpenstein
STOP Ransomware: Finger weg von illegalen Software-Downloads
STOP
2019-01-15 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Djvu Ransomware Spreading New .TRO Variant Through Cracks & Adware Bundles
STOP
2018-08-13 ⋅ Kaspersky Labs ⋅ Fedor Sinitsyn, Orkhan Mamedov
KeyPass ransomware
STOP
Yara Rules
[TLP:WHITE] win_stop_auto (20241030 | Detects win.stop.)
rule win_stop_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.stop."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stop"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 83c404 8b4b04 b8abaaaa2a 2b0b f7e9 8bcf }
            // n = 7, score = 600
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   8b4b04               | mov                 ecx, dword ptr [ebx + 4]
            //   b8abaaaa2a           | mov                 eax, 0x2aaaaaab
            //   2b0b                 | sub                 ecx, dword ptr [ebx]
            //   f7e9                 | imul                ecx
            //   8bcf                 | mov                 ecx, edi

        $sequence_1 = { ff15???????? 8b35???????? 8b3d???????? 6a01 6a00 6a00 6a00 }
            // n = 7, score = 600
            //   ff15????????         |                     
            //   8b35????????         |                     
            //   8b3d????????         |                     
            //   6a01                 | push                1
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6a00                 | push                0

        $sequence_2 = { ffd7 6a01 6a00 6a00 6a00 8d45e0 50 }
            // n = 7, score = 600
            //   ffd7                 | call                edi
            //   6a01                 | push                1
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   8d45e0               | lea                 eax, [ebp - 0x20]
            //   50                   | push                eax

        $sequence_3 = { 50 ffd6 85c0 75e8 6a0a ff7304 ff15???????? }
            // n = 7, score = 600
            //   50                   | push                eax
            //   ffd6                 | call                esi
            //   85c0                 | test                eax, eax
            //   75e8                 | jne                 0xffffffea
            //   6a0a                 | push                0xa
            //   ff7304               | push                dword ptr [ebx + 4]
            //   ff15????????         |                     

        $sequence_4 = { 83c404 8b4b04 b8abaaaa2a 2b0b }
            // n = 4, score = 600
            //   83c404               | add                 esp, 4
            //   8b4b04               | mov                 ecx, dword ptr [ebx + 4]
            //   b8abaaaa2a           | mov                 eax, 0x2aaaaaab
            //   2b0b                 | sub                 ecx, dword ptr [ebx]

        $sequence_5 = { ffd6 85c0 75e2 5f }
            // n = 4, score = 600
            //   ffd6                 | call                esi
            //   85c0                 | test                eax, eax
            //   75e2                 | jne                 0xffffffe4
            //   5f                   | pop                 edi

        $sequence_6 = { 83c102 eb84 6a0c 68???????? e8???????? 8b7d08 33c9 }
            // n = 7, score = 600
            //   83c102               | add                 ecx, 2
            //   eb84                 | jmp                 0xffffff86
            //   6a0c                 | push                0xc
            //   68????????           |                     
            //   e8????????           |                     
            //   8b7d08               | mov                 edi, dword ptr [ebp + 8]
            //   33c9                 | xor                 ecx, ecx

        $sequence_7 = { 6a00 6a00 8d45e0 50 ffd6 85c0 741e }
            // n = 7, score = 600
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   8d45e0               | lea                 eax, [ebp - 0x20]
            //   50                   | push                eax
            //   ffd6                 | call                esi
            //   85c0                 | test                eax, eax
            //   741e                 | je                  0x20

        $sequence_8 = { 57 6a00 8bd9 6a00 6a12 ff33 ff15???????? }
            // n = 7, score = 600
            //   57                   | push                edi
            //   6a00                 | push                0
            //   8bd9                 | mov                 ebx, ecx
            //   6a00                 | push                0
            //   6a12                 | push                0x12
            //   ff33                 | push                dword ptr [ebx]
            //   ff15????????         |                     

        $sequence_9 = { 75e8 6a0a ff7304 ff15???????? 3d02010000 74c4 }
            // n = 6, score = 600
            //   75e8                 | jne                 0xffffffea
            //   6a0a                 | push                0xa
            //   ff7304               | push                dword ptr [ebx + 4]
            //   ff15????????         |                     
            //   3d02010000           | cmp                 eax, 0x102
            //   74c4                 | je                  0xffffffc6

    condition:
        7 of them and filesize < 6029312
}
Download all Yara Rules