STOP Ransomware (DJVU Ransomware) is high-risk widespread encryption virus, that first appeared near 1 year ago. It experienced several visual and technical changes throughout the time. In this tutorial we will analyse recent versions of this dangerous malware. In April of 2019, STOP Ransomware started to add following extensions to encrypted files: .browec, .guvara, .etols, .grovat or .grovas. They are sometimes called “Browec Ransomware”, “Guvara Ransomware”, “Etols Ransomware”, “Grovas Ransomware” and “Grovat Ransomware” respectively. Virus also modifies the hosts file to block Windows updates, antivirus programs, and sites related to security news or offering security solutions. The process of infection also looks like installing of Windows updates, malware shows fake window, that imitates update process.
STOP Ransomware is large family of encryption viruses with over than a year history. It has undergone multiple visual and technical modifications during the time. This article will describe peculiar properties of latest versions of this malware. Since the end of March, STOP Ransomware started to add following extensions to encrypted files: .raldug, .refols, .roland, .tronas or .trosak. The cost of decryption of files encrypted by STOP Ransomware is $980 (or for $490, if ransom is paid within 72 hours). Hackers should send special decryption tool, that will decode affected files. However, we must warn the victims, that malefactors often don’t keep promises, and don’t send the decoder. We recommend you to remove active infection of STOP Ransomware and use decryption tools available. STOPDecrypter is capable of decryption of .raldug, .refols, .roland, .tronas or .trosak files. You can also try manual guide in this article to attempt restoring files.
Notorious STOP Ransomware continues its distribution with minor modifications. Since the end of February 2019, new extensions appeared: .kropun, .kropun1, .kroput or .kroput1. At the same time, it distributes the AZORult trojan-stealer, which steals confidential information. It is capable of stealing various user data: information from files, browser history, passwords, cookies, online banking credentials, crypto-currency wallets, and more. Virus modifies the hosts file to block Windows updates, antivirus programs, and sites related to security news, selling antivirus software. This version of STOP Ransomware still uses following e-mail addresses: email@example.com and firstname.lastname@example.org.
STOP Ransomware is file-encrypting ransomware-type virus, that encrypts user files using AES (режим CFB) encryption algorithm. DJVU Ransomware is identified as variation of STOP Ransomware. Virus appends .djvu, .udjvu or .djvuu extension to encrypted files, what can embarrass some users, as this is popular file format for e-books and storing scanned documents. When encryption is finished DJVU Ransomware places _openme.txt text file with following content in the folders with affected files and on the desktop.