Encrypted data by STOP (DJVU) ransomware family.
We must note that in most cases involving this ransomware family, there is little we can do because the data is encrypted using RSA and an online key. However, in this case, at the time of infection, the malware did not have access to its control server (the Internet), likely blocked by a firewall. Because of this, the data was encrypted with an offline key (embedded within the malware itself), indicated by the user identifier suffix “tt1” (GPslRImEtL7fKG7m94uVxPiCMecLfH3TAC0mtt1), for which we have the key.
First, all data (*.jpg, *.doc, *.mp4, etc.) was exported to our available server. Using a specialized decryption tool tailored for this case, the exported data was successfully decrypted. The computer was cleaned using special methods to ensure the malware could not survive. A fresh Windows 10 operating system was installed, and the decrypted data was restored to its original locations.