Description
Stop (a.k.a. KeyPass, Djvu) is a ransomware family that spread massively through spam messages on Discord and bundled downloads, and it encrypts files with appended extensions while leaving ransom demands. Its operators released frequent variant updates, and its campaigns distributed further stealers alongside the encryptor. The family's enormous volume and long run made it one of the most encountered ransomware detections for consumer users, and public decryptors exist for many of its variants.
Stats
- First seen
- May 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Gen:Variant.Ransom.Stop.1 |
| Gen:Variant.Ransom.Stop.53 |
| Gen:Variant.Ransom.Stop.57 |
| Generic.Ransom.Stop.2DDC5443 |
| Generic.Ransom.Stop.59BDDCFD |
| Script-BAT.Ransomware.Stop |
| Trojan.Ransom.Stop.A |
| Trojan.Ransom.Stop.E |
| Win32.Ransomware.Stop |