Log in Request a demo

Ransomware

[Research Summary]: Stop/Djvu Ransomware

Stop/Djvu ransomware analysis: how it encrypts files, marks them with varied extensions, drops _readme.txt ransom notes, and a report you can download.

Brandefense logo Updated 4 Min Read
stop-djVu ransomware explained by Brandefense analysts

Stop/Djvu is a family of Windows ransomware. It encrypts the files on a computer, marks them with changing file extensions, and leaves a ransom note called _readme.txt in each folder. Victims are told that files can only be recovered by buying a decryption tool and a unique key. This post covers how the analyzed sample runs and how it spreads.

This blog post comes from the “Stop/Djvu Ransomware Technical Analysis” by the Brandefense CTI Analyst Team. For more details about the analysis, download the report.

What is Stop/Djvu ransomware?

Stop/Djvu ransomware is a malicious computer virus that aims to encrypt all files on the system and make them inaccessible and it can use many different extensions to mark encrypted files. The malware also creates money-demanding notes in each folder, naming them as _readme.txt. The cybercriminals demand paying a ransom to them in exchange for data decryption tools.

The ransom note contains two email addresses that victims are told to contact quickly, because the price of the decryption tools goes up if they wait. It is emphasized that the decryption of files is only possible with the purchase of decryption software and a unique key.

The analyzed malware exhibits multiple functionalities. Upon execution, it loads additional libraries, generates shellcode at runtime, and creates a self-copy. The main payload is then injected, and a UUID is generated to use as the directory’s name, where the malware is copied. The malware uses XOR encryption with a hardcoded key to decrypt relevant strings and hashes the buffer containing the MAC address using MD5.

To achieve persistence, the ransomware employs the ITaskService interface of the TaskScheduler COM object to create a scheduled task and create a mutex value. Once persistence is established, the malware encrypts all files on the system and communicates with its C2 server using WinINet functions.

How the analyzed sample runs
  1. Payload injectedShellcode is generated, a self-copy is made and the main payload is injectedTechnique T1055 (MITRE ATT&CK, opens in a new tab)
  2. Persistence set upScheduled task and mutex createdTechnique T1053 (MITRE ATT&CK, opens in a new tab)
  3. Files encryptedAll files on the system are encryptedTechnique T1486 (MITRE ATT&CK, opens in a new tab)
  4. Contacts the C2 serverUses WinINet functionsTechnique T1071 (MITRE ATT&CK, opens in a new tab)

Overview

File Name: 7d208dd86e75c9c5900a85b08ef0b070.exe
MD5: 7d208dd86e75c9c5900a85b08ef0b070
SHA-1: 79a453d4e5403307b54205094ded4e5ff0382c71
SHA256: 4380c45fd46d1a63cffe4d37cf33b0710330a766b7700af86020a936cdd09cbe

File Name: stop.exe
MD5: 74c7126ff188eb5f72fee4b4eb4cfc23
SHA-1: c9545f039159ceb8413b2ca6d83b06dca86b5839
SHA256: adeb345ba0d60fecdb0823d0cb713c933900ecb545025ec8cc3f442d844af24b

Where does Stop/Djvu come from?

Stop/Djvu is a family of ransomware. The malware was designed to encrypt user files and demand a ransom payment for their decryption. New variants have continued to be released over time.

How does Stop/Djvu spread?

Stop/Djvu primarily targets individual users and small businesses running Windows operating systems. The delivery method typically involves the use of software cracks or illegal activation tools, which are often downloaded from torrent sites or other untrustworthy sources. These cracks or activation tools are disguised as legitimate software and can be bundled with Stop/Djvu ransomware, infecting the victim’s system upon installation.

Another delivery method involves spam emails containing malicious attachments, such as fake invoices or job offers, which download and execute the ransomware when opened.

Behavior Graph of Stop/Djvu Ransomware

behaviour graph for stop/djvu ransomware
Figure 1: Behavior graph

MITRE ATT&CK Threat Matrix

  1. TA0002 Execution
    1. T1053 Scheduled Task/Job
  2. TA0003 Persistence
    1. T1547.001 Registry Run Keys/Startup Folder
  3. TA0004 Privilege Escalation
    1. T1055 Process Injection
  4. TA0005 Defense Evasion
    1. T1036 Masquerading
    2. T1497 Virtualization/Sandbox Evasion
  5. TA0007 Discovery
    1. T1018 Remote System Discovery
    2. T1057 Process Discovery
    3. T1082 System Information Discovery
    4. T1083 File and Directory Discovery
  6. TA0011 Command and Control
    1. T1071 Application Layer Protocol
    2. T1095 Non-Application Layer Protocol
    3. T1573 Encrypted Channel
  7. TA0040 Impact
    1. T1486 Data Encrypted for Impact

Download IoCs and YARA Rules from GitHub.

Frequently Asked Questions.

What is Stop/Djvu ransomware?

It is a family of ransomware that encrypts files on Windows systems, marks them with varied extensions and drops a _readme.txt ransom note in each folder.

How does Stop/Djvu spread?

The post describes software cracks and illegal activation tools from untrustworthy sources, and spam emails with malicious attachments such as fake invoices or job offers.

How does Stop/Djvu stay on a system?

The analyzed sample uses the Task Scheduler COM interface to create a scheduled task and also creates a mutex.

Should you pay the ransom?

CISA's #StopRansomware Guide does not recommend paying. It notes that researchers sometimes find flaws in ransomware and release decryption tools.

How can you protect against ransomware like this?

CISA recommends offline, encrypted and regularly tested backups, email attachment filtering, user awareness training and timely patching.

Sources

  1. 1 MITRE ATT&CK T1486 Data Encrypted for Impact
  2. 2 MITRE ATT&CK Impact tactic TA0040
  3. 3 MITRE ATT&CK T1053 Scheduled Task/Job
  4. 4 MITRE ATT&CK T1055 Process Injection
  5. 5 CISA #StopRansomware Guide
Share

In This Article

TechniquesScheduled Task/Job TechniquesProcess Injection TechniquesData Encrypted for Impact TechniquesApplication Layer Protocol TechniquesRegistry Run Keys / Startup Folder TermsRansomware TermsPersistence TermsCommand and control (C2)

Where To Next.

All Ransomware Articles
In plain words · Glossary term Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Open → Keep reading · Article Echida Stealer Technical Analysis

Echida Stealer is a C# malware that steals data and takes remote commands.

Open → Keep reading · Article Comparing Cyber Security Attacks in Q3 – Q4 of 2022 for the Manufacturing Sector

Compare ransomware attacks on the manufacturing sector in Q3 and Q4 of 2022, see why factories are targeted, and learn practical steps to reduce…

Open →

Knowledge HubRansomware groups