Full Report
What happens when you combine ransomware with information stealers, remote access Trojans, and other malware in one easy-to-download package?
Analysis Summary
# Tool/Technique: DJVU/STOP Ransomware & Infostealer Bundles
## Overview
This threat involves the delivery of highly destructive "all-in-one" malware packages. Threat actors are increasingly combining the **DJVU (STOP)** ransomware variant with various information stealers (such as Vidar and RedLine) and Remote Access Trojans (RATs). This multi-stage attack aims to first exfiltrate sensitive data (credentials, financial info) and subsequently encrypt the victim's files to demand a ransom, maximizing the profit from a single infection.
## Technical Details
- **Type:** Malware Family / Bundle (Ransomware + Infostealer)
- **Platform:** Windows
- **Capabilities:** Credential theft, data exfiltration, file encryption, anti-analysis, C2 communication via social media dead-drop resolvers.
- **First Seen:** DJVU/STOP has been active since approximately 2018; integrated bundles are a continuing evolution.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059.001 - PowerShell
- T1218.011 - Rundll32
- **TA0005 - Defense Evasion**
- T1562.001 - Disable or Modify Tools (Windows Defender)
- T1055.012 - Process Hollowing
- **TA0007 - Discovery**
- T1614 - System Location Discovery
- T1083 - File and Directory Discovery
- T1135 - Network Share Discovery
- **TA0009 - Collection**
- T1119 - Automated Collection
- T1560 - Archive Collected Data
- **TA0011 - Command and Control**
- T1102.001 - Dead Drop Resolver (Telegram/Social Media)
- T1095 - Non-Application Layer Protocol (net.tcp)
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact
## Functionality
### Core Capabilities
- **Information Theft:** Stealers like Vidar and RedLine automatically harvest browser cookies, saved passwords, crypto wallets, and Discord/Telegram session tokens.
- **Ransomware Encryption:** DJVU/STOP encrypts user files and appends extensions (e.g., .meds, .mljx) while dropping a `_readme.txt` ransom note.
- **Persistence & Execution:** Uses PowerShell with hidden window styles and `Rundll32` to execute malicious DLL payloads.
### Advanced Features
- **Dead Drop Resolvers:** Vidar utilizes Telegram channel descriptions or social media profiles to store and update C2 IP addresses, making infrastructure harder to take down.
- **Process Hollowing:** The ransomware payload is often injected into legitimate processes to evade detection.
- **Geofencing:** Checks system language and time zones; often avoids infecting systems in CIS (Commonwealth of Independent States) countries.
## Indicators of Compromise
- **File Names:** `_readme.txt` (Ransom note), various randomized `.exe` and `.dll` files in `%AppData%` or `%LocalAppData%`.
- **Network Indicators:**
- `t[.]me/xxxxxx` (Telegram channels used as resolvers)
- Communications over `net.tcp` (RedLine default)
- C2 IPs: `77[.]91[.]69[.]xxx`, `95[.]217[.]xxx[.]xxx` (Defanged)
- **Behavioral Indicators:**
- Execution of PowerShell with `-WindowStyle Hidden`.
- Disabling of `WinDefend` service via registry or command line.
- Massive file renaming activity (encryption).
## Associated Threat Actors
- While DJVU is often distributed by affiliates of the **STOP** ransomware family, the specific bundles are frequently linked to cybercriminals operating in the **Private Loader** or **SmokeLoader** ecosystems.
## Detection Methods
- **Signature-based:** Antivirus signatures for known DJVU, Vidar, and RedLine samples.
- **Behavioral:** Monitoring for unauthorized modifications to Windows Defender settings and detection of Process Hollowing (T1055.012).
- **YARA:** Rules targeting the unique string patterns in the DJVU ransom note and the Vidar configuration block.
## Mitigation Strategies
- **Prevention:** Implement strict Application Whitelisting and block execution from `%AppData%` folders where possible.
- **Hardening:** Disable PowerShell for non-administrative users and enforce Multi-Factor Authentication (MFA) to mitigate the impact of stolen credentials.
- **Backup:** Maintain offline, immutable backups to recover from ransomware encryption without paying.
## Related Tools/Techniques
- **RedLine Stealer:** Often bundled for credential harvesting.
- **Vidar Stealer:** A fork of Arkei stealer used for data exfiltration.
- **SmokeLoader:** Often serves as the initial downloader for these bundles.