停止Djvu勒索軟件

STOP勒索軟件家族（也稱為STOP Djvu Ransomware家族）是一種威脅很大的惡意軟件。儘管STOP Djvu的某些影響文件類型和加密文件擴展名的方法有所不同，但它們只是具有共同特徵並起源於STOP勒索軟件的多種威脅之一。

最初的STOP Ransomware早在2018年2月就被安全研究人員發現。但是，從那時起，它就得到了發展，其克隆和分支產品家族也不斷增加。分發STOP勒索軟件的主要方法是使用損壞的附件發送垃圾郵件活動。

STOP Djvu勒索軟件的執行方式類似於同類的其他勒索軟件威脅，對用戶可能在其係統中使用的關鍵文件進行加密和阻止訪問。可以對個人文件，圖片，文檔等進行加密，並且基本上禁止計算機上的所有用戶使用。 STOP Djvu勒索軟件最初於2018年12月被發現，這似乎是一個非常成功的在線感染活動。研究人員並未意識到勒索軟件的傳播方式，但後來的受害者報告說，他們在下載密鑰源或破解程序後發現了感染。一旦發生滲透，STOP Djvu勒索軟件會更改Windows設置，並在文件中附加一系列名稱，例如.djvu，.djvus，.djvuu，.uudjvu，.udjvu或.djvuq，以及最近的.promorad和.promock擴展名。較新的版本還沒有解密器，但是較舊的版本可以使用STOPDecrypter解密。建議用戶無論如何避免支付任何贖金。

用於阻止訪問文件的方法使用RSA加密算法。儘管對於沒有經驗的用戶來說，解密文件似乎很困難，但是絕對不需要付出任何努力來支付威脅背後的人員。在這種情況下通常會提供虛假承諾，因此用戶付款後很快就會發現它們被忽略了。

STOP Djvu勒索軟件的攻擊於2018年末首次報導。STOPDjvu的主要分發方法仍然是垃圾郵件，並且針對勒索軟件核心的調整相對較小。垃圾郵件中使用的大多數偽造的，受感染的附件都是啟用宏的辦公文檔或偽造的PDF文件，它們在受害者不知情的情況下運行勒索軟件。 STOP Djvu的行為也沒有太大變化-勒索軟件仍會刪除所有Shadow Volume快照以擺脫備份，然後開始加密受害者的文件。

贖金記錄有一些細微變化，該記錄另存為" _openme.txt"到受害者的桌面。贖金說明的文本可以在這裡找到：

'[贖金開始]
————————加密您的所有文件————————

不用擔心，您可以返回所有文件！
您所有的文件文檔，照片，數據庫和其他重要文件均使用最強的加密和唯一密鑰進行加密。
恢復文件的唯一方法是為您購買解密工具和唯一密鑰。
該軟件將解密您所有的加密文件。
我們為您提供什麼保證？
您可以從PC發送加密文件之一，而我們將免費對其進行解密。
但是我們只能免費解密1個文件. 文件中不得包含有價值的信息
不要嘗試使用第三方解密工具，因為它會破壞您的文件。
如果您在72小時內與我們聯繫，可享受50％的折扣。

——————————————————————————————————

要獲得此軟件，您需要在我們的電子郵件中寫信：
helpshadow@india.com

保留電子郵件地址與我們聯繫：
helpshadow@firemail.cc

您的個人ID：[字符串]
[贖金結束]'

勒索軟件將自身限制為最初以.djvu擴展名重命名加密的文件，這是一個很好的選擇，因為.djvu實際上是由AT＆T Labs開發的合法文件格式，用於存儲掃描的文檔，有點類似於Adobe的.pdf。更高版本的勒索軟件對加密文件採用了一系列其他擴展名，包括" .chech"，"。luceq"，"。kroput1"，"。charck"，"。kropun"，"。luces"，"。pulsar1"，"。 ''.uudjvu'，'。djvur，'。tfude，'。tfudeq'和'.tfudet'。

可以使用安全研究人員Michael Gillespie開發的所謂的" STOPDecrypter"來免費解密STOP Djvu勒索軟件的某些菌株，並可以在線免費下載。

目錄

Toggle

停止Djvu勒索軟件視頻

提示：把你的声音并观察在全屏模式下的视频。

停止Djvu勒索軟件 截图

分析报告

一般信息

Family Name:	STOP/DJVU Ransomware
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: def8a7bfe5fe47d95a95085d8dbc7a53 SHA1: 7182d4b2f55a560d83edf0824e119f71fa8422b6 SHA256: B83855EA63E7F28396099A5B6E877BE537E78E4A50DF720262461A1D13B02192 文件大小: 6.29 MB, 6292105 bytes

MD5: a6b8c0cb178c31dd347554c3e5a0d5f8 SHA1: 91864f269d696ee80869cfeb3c9a204f8031a3bb SHA256: 4FFB8E9ADF508662B5E51CBEC75B2E07CE1CBBFAAB873F72EDC7BAC385421E2C 文件大小: 3.47 MB, 3471869 bytes

MD5: 2336c9624d9a44c393d354206226f508 SHA1: ea7edc388ad62990f52b9ed40df26d20f4e20190 SHA256: CE48ED04C92143B7E91F9665DD9337B2EE0B9CC1B5AEE534D26C09E084F8ABB0 文件大小: 1.36 MB, 1359918 bytes

MD5: 42f32aa699bc45a3638ddeb325ebebc1 SHA1: 508cea3ba2bf04cc6851295f92bf0e752071f6b8 SHA256: 16532B38591B713395C288B11610494BCC4C4537BE492D43C54D66FEB7B95FA4 文件大小: 1.33 MB, 1328186 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

姓名	价值
Comments	This installation was built with Inno Setup.
Company Name	Alexander Roshal WinTools Software Engineering, Ltd.
File Description	Gestione archivi WinRAR RAM Saver Professional
File Version	26.0.1 25.7.1 6.20.2 1.00
Internal Name	TJprojMain WinRAR
Legal Copyright	Copyright © Alexander Roshal 1993-2022
Original Filename	TJprojMain.exe WinRAR.exe
Product Name	Project1 RAM Saver 25.7.1 Professional RAM Saver 26.0.1 Professional WinRAR
Product Version	26.0.1 25.7.1 6.20.2 1.00

File Traits

• 2+ executable sections
• big overlay
• HighEntropy
• Installer Manifest
• No Version Info
• RAR (In Overlay)
• RARinO
• SusSec
• vb6
• WinRAR SFX

Show More

• WRARSFX
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\is-13e8d.tmp\508cea3ba2bf04cc6851295f92bf0e752071f6b8_0001328186.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-88uan.tmp\ea7edc388ad62990f52b9ed40df26d20f4e20190_0001359918.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-pk5hm.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-shkd6.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Other Suspicious	SetWindowsHookEx
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Keyboard Access	GetKeyState

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Lehsoaco\AppData\Local\Temp\is-88UAN.tmp\ea7edc388ad62990f52b9ed40df26d20f4e20190_0001359918.tmp" /SL5="$5036E,928289,131584,c:\users\user\downloads\ea7edc388ad62990f52b9ed40df26d20f4e20190_0001359918"

"C:\Users\Dfhrhqtz\AppData\Local\Temp\is-13E8D.tmp\508cea3ba2bf04cc6851295f92bf0e752071f6b8_0001328186.tmp" /SL5="$802E8,896816,131584,c:\users\user\downloads\508cea3ba2bf04cc6851295f92bf0e752071f6b8_0001328186"