{
  "family": "stop",
  "sample_count": 8900,
  "category": "ransomware",
  "description": "STOP (universally recognized across consumer cybersecurity forums and threat feeds as STOP/Djvu) is the single most prevalent consumer ransomware family in cyber history by raw victim count. Active since late 2018, STOP specifically targets home consumers, remote workers, and small business operators by distributing its payloads through trojanized software cracks, warez torrents, key generators (such as fake KMSPico activators), and pirated media bundles. Once executed on a Windows system, the ransomware attempts to reach its centralized command-and-control servers to obtain an 'Online Key' (a unique public RSA key generated per victim). If the host is disconnected or firewalled from the C2 server, STOP falls back to an embedded hardcoded 'Offline Key' that is shared across thousands of victims. The malware traverses all mounted fixed and removable drives, encrypting victim personal files (documents, images, videos, databases) using high-speed AES-256 encryption and appending unique extension tags (with hundreds of observed variants including .djvu, .stop, .gero, .coot, .tisc, and .peet). In over 60% of modern infections, STOP simultaneously deploys secondary infostealers (such as Vidar or RedLine) to harvest stored browser credentials and cryptocurrency wallets before the ransom note (_readme.txt) is displayed.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "STOP/Djvu",
    "Djvu Ransomware",
    "Ransomware:Win32/Stop",
    "Trojan-Ransom.Win32.Stop",
    "Djvu"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is STOP/Djvu ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "STOP/Djvu is a prolific consumer-targeting ransomware family that encrypts personal documents and multimedia files using AES-256, distributed primarily through trojanized software cracks and key generators."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted by STOP/Djvu be decrypted for free?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Files encrypted with an 'Offline Key' (indicated by a victim ID ending in 't1') can be decrypted for free using the Emsisoft STOP/Djvu Decryption Tool developed by Michael Gillespie. Files encrypted with unique 'Online Keys' cannot currently be decrypted without private keys."
      }
    },
    {
      "@type": "Question",
      "name": "How does STOP/Djvu infect computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "STOP/Djvu infects endpoints when users download and execute pirated software, cracked games, video editing software patches, or fake activator tools from torrent sites and deceptive YouTube tutorials."
      }
    },
    {
      "@type": "Question",
      "name": "Why are passwords stolen during a STOP ransomware infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "STOP ransomware payloads are frequently bundled with secondary information stealers like Vidar or RedLine, which silently extract saved browser passwords, session cookies, and cryptocurrency wallets prior to encrypting files."
      }
    },
    {
      "@type": "Question",
      "name": "What should victims do immediately after a STOP/Djvu infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately disconnect the machine from the internet, preserve the C:\\SystemID\\PersonalID.txt file to identify the key type, scan with reputable antivirus to remove stealer trojans, and change all account passwords from an uninfected device."
      }
    },
    {
      "@type": "Question",
      "name": "What is the architectural difference between STOP/Djvu online keys and offline hardcoded fallback encryption keys?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "When STOP/Djvu executes, it attempts to contact its C2 server to retrieve a unique RSA-2048 public key (the 'online key'). If the C2 server is unreachable or offline, the ransomware falls back to a hardcoded static public key embedded in the binary (the 'offline key'). For victims encrypted with an offline key, security researchers at Emsisoft were able to recover the corresponding private key, allowing victims to decrypt their files for free using the Emsisoft Decryptor for STOP/Djvu."
      }
    },
    {
      "@type": "Question",
      "name": "How does STOP/Djvu distribute through cracked software, keygens, and YouTube description links to target consumer systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "STOP/Djvu dominates consumer malware telemetry because it is distributed through high-volume warez networks, cracked software download portals, torrent trackers, and deceptive YouTube video descriptions promising free activation keys for games and video editors. Bundled with secondary infostealers (such as Vidar or RedLine), the malicious bundle steals passwords before encrypting personal files and appending extensions like .djvu, .gero, or .vve."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1059.003",
    "T1547.001",
    "T1083",
    "T1027",
    "T1056.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "impact"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "discovery"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "credential-access"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-16",
  "first_seen": 2018,
  "lineage": {
    "derived_from": [
      "stop early variant"
    ],
    "variants": [
      "djvu",
      "gero",
      "peet",
      "coot",
      "tisc",
      "derp"
    ]
  },
  "attribution": [
    {
      "actor": "STOP Cybercrime Syndicate",
      "confidence": "medium"
    }
  ],
  "exploited_cves": [],
  "c2_profile": {
    "protocols": [
      "HTTP",
      "HTTPS"
    ],
    "ports": [
      80,
      443
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "e23b2c93847849e7552eb412854c6020c644d622830f0f35a4d467888b13d2bb",
      "378d388656d07d12db9ad358be85233e721669466be9636c138f3ecb53a060d4"
    ],
    "delivery": [
      "cracked_software",
      "warez_torrents",
      "youtube_description_links",
      "fake_activators"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Scheduled Task Creation"
    ]
  },
  "sources": [
    {
      "name": "Emsisoft Threat Research: STOP/Djvu Ransomware Decryption Guide",
      "url": "https://www.emsisoft.com/en/ransomware-decryption/stop-djvu/"
    },
    {
      "name": "BleepingComputer: STOP Ransomware Technical Overview and Decryption",
      "url": "https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-pusu-djvu-etc-support-topic/"
    },
    {
      "name": "Malwarebytes Labs: Threat Spotlight on STOP/Djvu Ransomware",
      "url": "https://www.malwarebytes.com/blog/threat-spotlight/2019/07/stop-djvu-ransomware"
    }
  ],
  "containment_steps": [
    "Disconnect the infected computer from local Wi-Fi and Ethernet networks immediately.",
    "Examine C:\\SystemID\\PersonalID.txt to inspect the assigned victim identifier; strings ending in 't1' indicate an Offline Key that is fully decryptable.",
    "Run an offline antivirus scan to eradicate co-installed infostealer payloads (Vidar, RedLine) before entering credentials.",
    "Change all banking, email, and social media passwords from a clean, separate device."
  ],
  "what_to_avoid": [
    "Never pay the ransom demand via cryptocurrency; STOP operators rarely deliver working keys to consumers.",
    "Do not download third-party paid 'decryption tools' from untrusted YouTube channels or forums; they are frequently secondary malware.",
    "Avoid downloading cracked software or keygens, which remain the near-exclusive initial access vector for STOP."
  ],
  "target_industries": [
    "consumers",
    "remote_workers",
    "education",
    "small_business"
  ],
  "motivation": "Financial Extortion & Secondary Credential Theft",
  "threat_actors": [
    "STOP Syndicate"
  ],
  "target_geographies": [
    "GLOBAL",
    "US",
    "IN",
    "BR",
    "ID",
    "PK",
    "RU",
    "PH"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "credential-access",
    "discovery",
    "impact"
  ],
  "ecosystem": [
    "windows"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}