As most ransomware STOP/DJVU encrypts files to make them inaccessible. After you pay the ransom (in bitcoins), the attackers send the tools and information needed to decrypt your files and make them accessible again. The encryption is very hard to ‘break’ but ransomware researcher every now and then have success creating decryption software. Some time… Read More »
I am working on a small repair tool that allows you to repair MP3 and WAV files that are affected by STOP/DJVU ransomware. To test it I need files encrypted by this ransomware. To repair WAV files the tool requires a reference file: A file recorded with the same device or same software as the… Read More »
Restart markers make the difference This YouTube channel by my friend and colleague Nguyễn Vũ Hà has many great examples of JPEG-Repair being used to repair STOP/DJVU ransomware affected files. This video in particular is a great showcase on how JPEG restart markers prevent corruption propagating through the JPEG image stream. As you can see… Read More »