STOP Ransomware

Quick facts

Ransomware Family

STOP

First Seen

December 1, 2017

Known Aliases

• STOP-Keypass
• STOP-Djvu
• Djvu

How STOP ransomware works

File modification behavior

STOP updates file modification timestamps after encryption.

File encryption patterns

STOP modifies encrypted files using specific patterns to mark them as encrypted:

Ransom note and payment demands

After encrypting files, STOP displays ransom notes demanding payment for file recovery:

notes/!readme.txt

notes/_openme.txt

notes/_readme.txt

Technical indicators

Associated executable files

The following executable files are associated with STOP ransomware:

• 0302_2019-02-03_15-41.exe
• 05177199.exe
• 08212099.exe
• 09446899.exe
• 1.bin
• 1.exe
• 1601_2019-01-16_22-58.exe
• 1846355404.EXE
• 1MBIKZ45.exe
• 20240829253.exe
• 23954824.exe
• 2401_2019-01-24_12-52.exe
• 3.exe
• 34EFCDSAX.EXE.TMP
• 34fedwfe.exe
• 39.exe
• 3b84.exe
• 3BD2J1DJ.exe
• 3c31.exe
• 3db3.exe
• 419b.exe
• 585939.exe
• 7F2E.EXE
• 850867.exe
• 8687460552.EXE
• A3E1binexe.exe
• afvtnii.exe
• aiecxdy.exe
• aludci.exe
• amix.exe
• aslejn.exe
• aylpsaww.exe
• ays3ueggw.exe
• azbmtwy.exe
• B2.tmp.exe
• bdpxte.exe
• be2.exe
• betting.exe
• bigthing.exe
• bin.bin
• bqiewt.exe
• brgrtv3f.exe
• brpwmfdl.exe
• bsvnx.exe
• build.exe
• buildp.exe
• buildz.exe
• Bujingle.exe
• Buskepas.exe
• cjebe.exe
• covf.exe
• CUsersabdoAppDataLocalde14c4d4-af10-40ba-b2e7-b7cd78dfba75FCEB.tmp.exe
• CUsersUsAppDataLocalda3f3088-b399-4c9e-9d41-a0f53620c708E214.tmp.exe
• cveog.exe
• DHL7YG.exe
• DJVU Ransomware.exe
• dmkdih.exe
• dubi.exe
• DW8VXDZI.exe
• edrgweasdvrb.exe
• efzdqtpc.exe
• enbyzga.exe
• eqmmweay.exe
• executable.exe
• eyrfrip.exe
• F9RT5XP5.exe
• factura.exe
• Fameros.exe
• fce.exe
• file.bin
• file.exe
• fjklzp.exe
• fkpbzs.exe
• fphemzq.exe
• fqkwzdo.exe
• fsprm.exe
• fumiefqw.exe
• funuir.exe
• fwnfeic.exe
• fyyfc.exe
• gapijonc.exe
• gayn.exe
• gazp.exe
• gdusei.exe
• gehfgfjk.exe
• gepquoqguv.exe
• gFaZbGmI
• gixj.exe
• glitters.exe
• gunshot.exe
• gvhhzwub.exe
• HerbalEssentials.exe
• hgxctcth.exe
• hlmoj.exe
• Huklus.exe
• humanity.exe
• Hungle.exe
• Hunlipaos.exe
• hvfcfwbh.exe
• hvlawaos.exe
• HYDOADC8.exe
• IEWO4X01.exe
• important.exe
• important_document.exe
• ISJ5KN4I.exe
• IVE39D.exe
• jrinzssq.exe
• jrsnygu.exe
• jsjof.exe
• jtdnwf.exe
• JTDNWF.EXE
• Keypass.exe
• killeryuga.exe
• km0TTTU1Ig.exe
• krgqwi.exe
• kyamstr.exe
• liegkzrz.exe
• load1903.exe
• logger270.exe
• lpjlujyr.exe
• lwxhwfcu.exe
• msoffice.exe
• mvsnmp.exe
• myfile.exe
• NUMXYW9D.exe
• olbkummk.exe
• oqrvau.exe
• oqvq.exe
• ozlep.exe
• PBER65.exe
• pbky.exe
• petshop.exe
• phpAdLvuq
• phpwXWVud
• pqqfom.exe
• proc.exe
• ProcessKiller.exe
• program.exe
• PUQ5X3W2.exe
• pzsjx.exe
• qdnhqd.exe
• qfnxti.exe
• qgrm9yxfr9.exe
• qhnvv.exe
• qnsuk.exe
• qoapybn.exe
• qtyzkum.exe
• qvwloVnL.exe
• qwvqvk.exe
• R2JL7SXH.exe
• redcsrvtf.exe
• report727.exe
• rewrtrbvfd.exe
• ridaigx.exe
• RJ9067X4.exe
• rlpvcs.exe
• ryuk.exe
• sample.mlw
• sbap.exe
• sbut.exe
• Setup160.exe
• sgsdfgds.exe
• sifrtud
• sndjxmz.exe
• software.exe
• sqlreader.exe
• start.exe
• starticon2.exe
• STOP.exe
• Stop.exe
• Stop7.exe
• svhost.exe
• swyfkv.exe
• talq.exe
• tcygx.exe
• Techniques.exe
• twgiwo.exe
• twgruos.exe
• tygrfed.exe
• ubmahi.exe
• ucxiwb.exe
• uiabfuuc.exe
• UIXF9YSH.exe
• ukqxssy.exe
• update.exe
• updatewin.exe
• updatewin1.exe
• uqksn.exe
• urpress.bin
• urpress.exe
• uvjhup.exe
• uwzqmrjc.exe
• vatup.exe
• vwmzyfx.exe
• wchnu.exe
• wcvqmaz.exe
• wcyn.exe
• WMPLAYER.EXE
• wmplayer.exe
• wnyknmp.exe
• xnnhvtk.exe
• xspf.exe
• ycnsqgn.exe
• yhom.exe
• yhtvjk.exe
• yipogls.exe
• yowa.exe
• ythgrfed.exe
• YTHGRFED.EXE
• yvircma.exe
• yvxi.exe
• zBeQxOa
• zejw.exe
• zldik.exe
• zplgo.exe
• zqvu.exe
• zstimge.exe
• zufocosq.exe
• ZXJ9GJ.exe
• zzz.exe
• rfcle.exe
• ckdlp.exe
• qorw.exe
• ljrhywfh.exe
• malware.exe
• gsqonx.exe
• jpcmgaay.exe
• crack.exe
• 4088.exe
• zbetcheckin_tracker_49.exe
• tngub.exe
• tlde.exe
• xukac.exe
• zunzzjvu.exe
• behasavunu.exe

Recovery and decryption tools

Decryption tools may be available for STOP. Review the resources below:

• STOPDecrypter
• STOP Djvu decryptor
• STOP Djvu Decryption

About this analysis

This STOP ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery, helping organizations defend against and recover from ransomware attacks like STOP.

Last updated: July 2, 2026