STOP/DJVU family ransomware - JPEG and RAW photos

[Joep]

STOP/DJVU seems to be rather widespread, mainly in Asia (judging by the number of requests for I get from that region).

I discovered by accident that I can repair JPEGs affected by this ransomware. After some modifications to my software most RAW photos too. Key factor is that the ransomware only encrypts the first 150 KB or so of the file.

Video is repairable too using one of the many tools that are able to repair MP4/MOV type videos by applying a header to the corrupt file.

Currently the STOP/DJVU decrypter supports 148 variants of this ransomware (https://www.bleepingcomputer.com/forums ... ort-topic/). Pre-requisite is that files are off-line encrypted.

So, in cases where decryption fails JPEG-Repair can be used to repair individual JPEG and RAW photos with some degradation to quality. In case JPEGs embed restart markers, original color can be fully restored too. JPEG-Repair can not batch this, each file requires manual intervention.

In this example JPEG-Repair glued a header on top of a corrupt JPEG. Part of it's standard routine is stripping from byte sequences that are invalid JPEG markers and as a result the data can now be decoded. You can clearly see the corrupt/encrypted portion of the file at the top of the image. Now you can cut corrupt bytes from the file and re-align the image using stuff bytes as shown in this video: https://youtu.be/aiLofQEPoEs.

2020-01-03 (1).jpg (78.89 KiB) Viewed 23598 times

[Joep]

https://www.disktuna.com/media_repair-f ... 3-mp4-3gp/

Free tool to repair some audio and video formats affected by STOP/Djvu. Requires reference file, so file shot with same device, to steal header from.

Media_Repair currently supports following file types:

WAV*
MP3
MP4*
M4V*
MOV*
3GP*

* reference file required

[lcoughey]

Cool. Thanks for sharing.

[Joep]

I can now also repair CR2, NEF and ARW raw photos from Canon, Nikon and Sony after they were encrypted by STOP. Need a reference file though.