STOP/Djvu ransomware

STOP, known as Djvu since late 2018, is a Windows file-encrypting family first seen in December 2017 and still the most common ransomware hitting home users. It encrypts with Salsa20, touching only the first 150 KB or so of each file, and adds a short lowercase extension. Early builds used names such as .djvu, .rumba or .radman; builds from 2020 onward mostly use four-letter strings such as .gero, .qbaa or .vehu, and hundreds of these exist. Every affected folder gets a note called _readme.txt (late-2018 builds wrote _openme.txt ) that sets a price near $980, halves it for contact inside 72 hours, offers one free test file and lists a personal ID. An ID ending in t1 usually means the built-in offline key was used because the PC could not reach the operators' server. The STOP Djvu decryptor from Emsisoft recovers files locked with an offline key the publisher has obtained; for builds released after August 2019, online-key infections are outside its reach. Victims are mostly individual Windows PCs that ran pirated software, key generators, cracks or fake activators. Some builds edit the hosts file so that security websites stop loading. The family runs no leak site and its note makes no threat to publish files. Many installers drop an information stealer (Vidar, RedLine, Raccoon or AZORult, depending on the wave) next to the encryptor, so passwords, browser sessions and wallet data on the PC should be treated as stolen. Uppercase builds such as .DATAWAIT and .KEYPASS, and the .puma group, are earlier STOP branches that predate the Djvu name.

Sources: Emsisoft, No More Ransom

File extensions: .mzqw, .isal, .erqw, .znsm, .bpsm, .zoqw, .poqw, .manw, .btnw, .mppn, .cosw, .hhee, .coaq, .vvmm, .hhmm, .ioqa, .iowd, .mztu, .iswr, .maos, .btos, .dapo, .hhoo, .gosw, .dazx, .goaq, .qazx, .bpws, .qapo, .mzop

Ransom note filenames: _openme.txt

Decryptor: A decryptor exists but covers only some builds. Checked 2026-10-29.

Scope: Emsisoft's free STOP Djvu decryptor restores files only when they were locked with an offline key Emsisoft has obtained. Files hit with an online key are not recoverable with it, and the old file-pair submission route does not apply to builds released after August 2019.

Data exfiltration risk: Likely — The encryptor itself does not steal files and there is no leak site. Many STOP/Djvu installers also run an information stealer, so credentials, cookies and crypto wallets on the infected PC are likely taken.

Systems typically targeted: Single Windows PCs, overwhelmingly home and student machines infected through cracks, keygens and fake activators. It encrypts local and attached drives and has no network-spreading component.

Do this first: Write down the personal ID at the bottom of _readme.txt: one ending in t1 points to the offline key, which is the case the STOP Djvu decryptor from Emsisoft can handle once that key is obtained. Assume a password stealer ran alongside the encryptor, so reset email, banking and social logins and revoke browser sessions from another device. Check the hosts file for entries blocking security sites, and keep encrypted files even if they cannot be recovered today, since new offline keys are added over time.

From the ransom note _readme.txt:

All your files are encrypted! To decrypt them you need to send a voucher code or Paysafecard Ukash at email: tenagliamirella[@]gmail[.]com In return you get a code to decrypt files. You can find more information here hxxp[://]ukash[.]com/uk/en/home.aspx or hxxp[://]www.paysafecard[.]com/choose-country/ PLEASE READ CAREFULLY! To avoid problems, TURN OFF YOUR ANTI-VIRUS! AKA restore your files WILL NOT! […]

Sources: Emsisoft