STOP (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.stop (Back to overview)

STOP

aka: KeyPass, Djvu

STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.

References

2023-05-26 ⋅ ZAYOTEM ⋅ Emirhan KESKİN
Stop Ransomware
STOP

2022-09-29 ⋅ Team Cymru ⋅ S2 Research Team
Seychelles, Seychelles, on the C(2) Shore: An overview of a bulletproof hosting provider named ELITETEAM.
Amadey Raccoon RedLine Stealer SmokeLoader STOP

2022-09-15 ⋅ Sekoia ⋅ Threat & Detection Research Team
PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer

2022-08-08 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader

2022-04-01 ⋅ Bleeping Computer ⋅ Lawrence Abrams
The Week in Ransomware - April 1st 2022 - 'I can fight with a keyboard'
Hive Dharma LockBit STOP SunCrypt

2022-02-08 ⋅ Intel 471 ⋅ Intel 471
PrivateLoader: The first step in many malware schemes
Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar

2022-01-19 ⋅ Gdata ⋅ Karsten Hahn
Malware vaccines can prevent pandemics, yet are rarely used
Emotet STOP

2021-12-22 ⋅ Ankura ⋅ Vishal Thakur
The ‘STOP’ Ransomware Variant
STOP

2021-12-20 ⋅ Vishal Thakur
DefendAgainst: Ransomware ‘STOP’/DJVU
STOP

2021-12-20 ⋅ Github (vithakur) ⋅ Vishal Thakur
STOP/DJVU Ransomware IOC List
STOP

2021-10-31 ⋅ CYBER GEEKS All Things Infosec ⋅ CyberMasterV
A detailed analysis of the STOP/Djvu Ransomware
STOP

2021-06-21 ⋅ cyble ⋅ cybleinc
DJVU Malware of STOP Ransomware Family Back with New Variant
STOP

2021-01-18 ⋅ Medium csis-techblog ⋅ Benoît Ancel
GCleaner — Garbage Provider Since 2019
Amadey Ficker Stealer Raccoon RedLine Stealer SmokeLoader STOP

2020-07-29 ⋅ ESET Research ⋅ welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor

2020-02-05 ⋅ Cybereason ⋅ Lior Rochberger, Assaf Dahan
The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware
Amadey Azorult Predator The Thief STOP Vidar

2020 ⋅ Blackberry ⋅ Blackberry Research
State of Ransomware
Maze MedusaLocker Nefilim Phobos REvil Ryuk STOP

2019-12-11 ⋅ Kaspersky Labs ⋅ Kaspersky
Story of the year 2019: Cities under ransomware siege
Scarab Ransomware STOP

2019-11-21 ⋅ G Data ⋅ Karsten Hahn, Stefan Karpenstein
STOP Ransomware: Finger weg von illegalen Software-Downloads
STOP

2019-01-15 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Djvu Ransomware Spreading New .TRO Variant Through Cracks & Adware Bundles
STOP

2018-08-13 ⋅ Kaspersky Labs ⋅ Orkhan Mamedov, Fedor Sinitsyn
KeyPass ransomware
STOP

Yara Rules

[TLP:WHITE] win_stop_auto (20230808 | Detects win.stop.)

rule win_stop_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.stop."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stop"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6a00 8d45e0 50 ffd6 85c0 75e2 6a64 }
            // n = 7, score = 600
            //   6a00                 | push                0
            //   8d45e0               | lea                 eax, [ebp - 0x20]
            //   50                   | push                eax
            //   ffd6                 | call                esi
            //   85c0                 | test                eax, eax
            //   75e2                 | jne                 0xffffffe4
            //   6a64                 | push                0x64

        $sequence_1 = { ffd0 5d c3 8b0d???????? 33d2 85c9 }
            // n = 6, score = 600
            //   ffd0                 | call                eax
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   8b0d????????         |                     
            //   33d2                 | xor                 edx, edx
            //   85c9                 | test                ecx, ecx

        $sequence_2 = { 57 6a00 8bd9 6a00 6a12 ff33 }
            // n = 6, score = 600
            //   57                   | push                edi
            //   6a00                 | push                0
            //   8bd9                 | mov                 ebx, ecx
            //   6a00                 | push                0
            //   6a12                 | push                0x12
            //   ff33                 | push                dword ptr [ebx]

        $sequence_3 = { 56 57 6a00 8bd9 6a00 6a12 }
            // n = 6, score = 600
            //   56                   | push                esi
            //   57                   | push                edi
            //   6a00                 | push                0
            //   8bd9                 | mov                 ebx, ecx
            //   6a00                 | push                0
            //   6a12                 | push                0x12

        $sequence_4 = { ff750c ff7508 ffd0 5d c3 8b0d???????? }
            // n = 6, score = 600
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   ff7508               | push                dword ptr [ebp + 8]
            //   ffd0                 | call                eax
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   8b0d????????         |                     

        $sequence_5 = { ff15???????? 50 e8???????? c745fc00000000 }
            // n = 4, score = 600
            //   ff15????????         |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0

        $sequence_6 = { 75e2 6a64 ff15???????? ffd3 }
            // n = 4, score = 600
            //   75e2                 | jne                 0xffffffe4
            //   6a64                 | push                0x64
            //   ff15????????         |                     
            //   ffd3                 | call                ebx

        $sequence_7 = { 68???????? 6a00 6a00 ff15???????? 33c9 894604 85c0 }
            // n = 7, score = 600
            //   68????????           |                     
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   33c9                 | xor                 ecx, ecx
            //   894604               | mov                 dword ptr [esi + 4], eax
            //   85c0                 | test                eax, eax

        $sequence_8 = { 6a00 ff15???????? 33c9 894604 }
            // n = 4, score = 600
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   33c9                 | xor                 ecx, ecx
            //   894604               | mov                 dword ptr [esi + 4], eax

        $sequence_9 = { 6a00 ff15???????? 33c9 894604 85c0 5e 0f95c1 }
            // n = 7, score = 600
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   33c9                 | xor                 ecx, ecx
            //   894604               | mov                 dword ptr [esi + 4], eax
            //   85c0                 | test                eax, eax
            //   5e                   | pop                 esi
            //   0f95c1               | setne               cl

    condition:
        7 of them and filesize < 6029312
}

Download all Yara Rules

STOP Propose Change

References

Yara Rules

STOP