stop 0 Posted January 18 Report Share Posted January 18 Hi. Check my result: Result: We have identified "STOP (Djvu)". This ransomware may be decryptable under certain circumstances. Please refer to the appropriate guide for more information. Identified by: ransomnote_email: [email protected] sample_extension: .omfl sample_bytes: [0x1FA1 - 0x1FC7] 0x7B33364136393842392D443637432D344530372D424538322D3045433542313442344446357D Click here for more information about STOP (Djvu). Case number: 726d8b53b044eb07e9af232ab5373643a40bca9e1611006311 Removed ransomware virus on my computer. But i'm not sure. And not format yet. Emsisoft stop/djvu decryptor tool doesn't decrpyt my files. How can i solve this problem? Thanks. My system: Win7 x64 with SSD (Intel system) _readme.txt Quote Link to post Share on other sites
GT500 878 Posted January 19 Report Share Posted January 19 This is a newer variant of STOP/Djvu. Fortunately your ID is an offline ID, however we don't yet have the private key for it. I recommend running the decrypter once every week or two so that you can see when we've been able to add the private key for your variant. There is more information at the following link:https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ 1 Quote Link to post Share on other sites
stop 0 Posted January 28 Author Report Share Posted January 28 Why Emsisoft Decryptor Tool not updating? Still at 1.0.0.5. Quote Link to post Share on other sites
stop 0 Posted January 28 Author Report Share Posted January 28 This virus(.omfl) why not infected in some files(steam etc.)? Isn't 154kb and over ? Quote Link to post Share on other sites
GT500 878 Posted January 29 Report Share Posted January 29 12 hours ago, stop said: Why Emsisoft Decryptor Tool not updating? Still at 1.0.0.5. It doesn't need to be updated. 12 hours ago, stop said: This virus(.omfl) why not infected in some files(steam etc.)? Isn't 154kb and over ? The ransomware will only encrypt certain types of files. Quote Link to post Share on other sites
stop 0 Posted January 29 Author Report Share Posted January 29 13 hours ago, GT500 said: It doesn't need to be updated. Why? Sorry, i don't understand what you mean. Look at this man: On 1/19/2021 at 9:24 AM, GT500 said: This is a newer variant of STOP/Djvu. Fortunately your ID is an offline ID, however we don't yet have the private key for it. I recommend running the decrypter once every week or two so that you can see when we've been able to add the private key for your variant. There is more information at the following link:https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ "This is a newer variant of STOP/Djvu..." and "however we don't yet have the private key" you said. If it's the new variant, why not update it to fix the new variant virus? This is the _readme.txt file content: ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool:https://we.tl/t-egvXx8HqOt Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0272omflAsdhkioO7OVYUyivYvPEI6nuQIcKXNx74ml0mkowpmDzt1 Quote Link to post Share on other sites
stop 0 Posted January 29 Author Report Share Posted January 29 (edited) URL the virus came to me: ******************* (Please don't click this URL) Edited January 30 by GT500 Removed links. Quote Link to post Share on other sites
GT500 878 Posted January 30 Report Share Posted January 30 9 hours ago, stop said: If it's the new variant, why not update it to fix the new variant virus? Because the decrypter already supports it. The reason it can't decrypt files encrypted by this newer variant is due to the fact that we don't have the private key for it's offline ID. We have to wait for a victim with an offline ID who paid the ransom to donate their private key to us. 1 1 Quote Link to post Share on other sites
GT500 878 Posted January 30 Report Share Posted January 30 9 hours ago, stop said: URL the virus came to me: ******************* (Please don't click this URL) Please don't post malicious links on our forums. If you would like for us to analyze a file, or a malicious URL (aka. link), then run it through VirusTotal and post the link to the analysis here for us to review. We can download files from VirusTotal, so anything you upload there we have access to. 1 Quote Link to post Share on other sites
Lara_H 0 Posted Wednesday at 05:05 PM Report Share Posted Wednesday at 05:05 PM On 1/30/2021 at 8:28 AM, GT500 said: Because the decrypter already supports it. The reason it can't decrypt files encrypted by this newer variant is due to the fact that we don't have the private key for it's offline ID. We have to wait for a victim with an offline ID who paid the ransom to donate their private key to us. I have the same problem too:(( Well this is the victim you're talking about so are you researching this? And when he informs you how will you inform us? Thanks Quote Link to post Share on other sites
GT500 878 Posted Thursday at 05:29 AM Report Share Posted Thursday at 05:29 AM 12 hours ago, Lara_H said: I have the same problem too:(( Well this is the victim you're talking about so are you researching this? And when he informs you how will you inform us? Thanks This ransomware hasn't changed much since it was first analyzed over 2 years ago. The only major change was when they switched to using RSA keys, which is what makes the ransomware non-decryptable. Right now there's no way to decrypt files that have been encrypted by the STOP/Djvu ransomware without having the private key for the ID embedded in the encrypted files. 1 Quote Link to post Share on other sites
Lara_H 0 Posted Thursday at 05:39 PM Report Share Posted Thursday at 05:39 PM 12 hours ago, GT500 said: This ransomware hasn't changed much since it was first analyzed over 2 years ago. The only major change was when they switched to using RSA keys, which is what makes the ransomware non-decryptable. Right now there's no way to decrypt files that have been encrypted by the STOP/Djvu ransomware without having the private key for the ID embedded in the encrypted files. Now there's no way but maybe in the future isn't it:( So please let me know then, ok? Thank you very much for your reply.. Quote Link to post Share on other sites
GT500 878 Posted yesterday at 05:04 AM Report Share Posted yesterday at 05:04 AM 11 hours ago, Lara_H said: Now there's no way but maybe in the future isn't it:( So please let me know then, ok? Thank you very much for your reply.. If law enforcement is able to catch the criminals or otherwise gain access to their servers and release their private keys for use in decrypters, then we can add them to our database so that everyone can get their files back. Our recommendation is to save a backup of your encrypted files and keep it in a safe place in case decryption is possible at some point in the future. We also recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters:https://www.bleepingcomputer.com/ If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news:https://www.bleepingcomputer.com/feed/ 1 Quote Link to post Share on other sites
Lara_H 0 Posted yesterday at 05:23 PM Report Share Posted yesterday at 05:23 PM 12 hours ago, GT500 said: If law enforcement is able to catch the criminals or otherwise gain access to their servers and release their private keys for use in decrypters, then we can add them to our database so that everyone can get their files back. Our recommendation is to save a backup of your encrypted files and keep it in a safe place in case decryption is possible at some point in the future. We also recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters:https://www.bleepingcomputer.com/ If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news:https://www.bleepingcomputer.com/feed/ Thank you very much for your reply, again.. I have already backed up my encrypted files. I'm just waiting for the time.. Will the site www.bleepingcomputer.com you say will publish the solution about OMFL decryptor? Ok, i will follow.. Thanks again:) Quote Link to post Share on other sites
GT500 878 Posted 14 hours ago Report Share Posted 14 hours ago 11 hours ago, Lara_H said: Will the site www.bleepingcomputer.com you say will publish the solution about OMFL decryptor? They'll usually publish a news article when a new decrypter is released, or when there's major news about an older decrypter being updated to decrypt more victims' files. They also have a help and support topic on their forums for STOP/Djvu, which you can monitor if you'd like:https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/ Quote Link to post Share on other sites
Lara_H 0 Posted 3 minutes ago Report Share Posted 3 minutes ago By the way, i will ask something: When i enter this site: https://decrypter.emsisoft.com/submit/stopdjvu and when i click browse take in "Encrypted file" OK. but second part it wants "Original file" so which file is? (If the original file does not exist anyway, i could open that file anyway).. Is the "Original file" is it Randome Note i take in but doesn't accept so announcing ""Invalid file pair; each file must be larger than 150KB"" so what does this mean or what file is this file if not? Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.