Loading malware…
STOP/Djvu is a Windows ransomware family that has been widely associated with infections of individual consumers and small businesses, including frequent victimization of students through pirated or cracked software ecosystems. It encrypts files on local drives, removable media, RAM disks, remote drives, and network shares, and drops ransom notes demanding payment for decryption. The malware uses Salsa20 for file encryption and protects per-file key material with RSA, while also maintaining an offline encryption path through an embedded public key when command-and-control communication is unavailable. Encrypted files are renamed with family-specific extensions that vary by campaign, and the malware writes a victim identifier used in ransom negotiations.
The family supports multiple execution modes and includes logic for persistence, network-aware encryption, and operational control. It commonly copies itself into a generated directory, establishes persistence through a user logon autorun entry and a recurring scheduled task, and can repeatedly relaunch itself. It enumerates logical drives and network resources to maximize file impact, while excluding selected system files and directories to preserve system stability. Some variants also attempt to stop services before encryption.
STOP/Djvu incorporates defense-evasion and anti-analysis features, including string obfuscation, shellcode staging, and process hollowing. It also performs geolocation checks and avoids encrypting systems in several CIS-linked countries, a behavior consistent with many financially motivated malware families operating from the Russian-speaking cybercrime ecosystem.
Beyond encryption, analyzed samples have shown downloader behavior, retrieving and executing additional commodity malware such as information stealers and banking malware. This makes STOP/Djvu notable not only as ransomware but also as part of broader criminal distribution chains. The family has also appeared in cybercrime marketplaces and cracked-builder offerings, lowering the barrier to entry for affiliates and copycat operators. Overall, STOP/Djvu is a commodity ransomware family focused on high-volume attacks against less mature targets, often delivered through deceptive software-download channels rather than enterprise intrusion tradecraft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
A second persistence mechanism consists of creating a scheduled task (using COM objects) that will run the ransomware every 5 minutes.
A second persistence mechanism consists of creating a scheduled task (using COM objects) that will run the ransomware every 5 minutes.
The ransomware creates a copy of itself in a suspended state via a call to CreateProcessA... The malicious binary unmaps a view of a section from the address of the newly created process using ZwUnmapViewOfSection... writes data to the area allocated above using multiple calls to ZwWriteVirtualMemory... SetThreadContext... ResumeThread.
The binary performs a lot of XOR operations (key = 0x80) in order to decrypt relevant strings.
The malware calls the LoadLibraryW function... The GetProcAddress API is utilized to retrieve the address of the “VirtualProtect” function... The binary retrieves the address of the following functions using GetProcAddress...
KryptoCibule, cryptocurrency-focused malware that targeted Czech and Slovak users, was spread through a popular local file sharing service, masquerading as pirated games or downloadable content (DLC) for them.
The ransomware creates a copy of itself in a suspended state via a call to CreateProcessA... The malicious binary unmaps a view of a section from the address of the newly created process using ZwUnmapViewOfSection... writes data to the area allocated above using multiple calls to ZwWriteVirtualMemory... SetThreadContext... ResumeThread.
The file from above is deleted in any case... After the batch file finishes its execution, the malicious file and the script are deleted.
The executable retrieves the user name associated with the current thread by calling the GetUserNameW API.
All process IDs that correspond to the processes on the system are retrieved by calling the EnumProcesses API.
GetAdaptersInfo is utilized to retrieve adapter information (including the MAC address) for the localhost.
The files are enumerated using the FindFirstFileW and FindNextFileW APIs... The directories mentioned under figure 89 will not be encrypted.
The malware enumerates all resources on the network via a function call to WNetOpenEnumW... WNetEnumResourceW is utilized to further enumerate the network resources.
The binary performs a GET request to the C2 server securebiz[.]org with the parameter pid = MD5(MAC address).
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family referenced via a cracked builder; described as targeting individual consumers and small businesses.
A ransomware family observed among payloads downloaded by PrivateLoader during early November 2021.
Referenced ransomware family; Zorab impersonates a decryptor for STOP/Djvu to trick victims into executing Zorab.
Ransomware strain listed among those with smaller average/median payment sizes in 2023.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.