Tools to decrypt files encrypted by STOPDjvu ransomware. Thanks to Emsisoft for the decryption logic, keystream generation logic and all my below understanding comes from them.

Important Note: Although I understand the logic correctly and extract keystreams on our own, comparing them shows we are doing something wrong. Recommendation is to use Emsisoft website to upload files and get them to compute keystreams properly.

What hackers do:

1. Generate Master Key - Hackers possess a master key which they use to encrypt files
2. Create Unique System ID - Each infected system gets a unique 40-character ID like "BE7eWxxxxxxxxfwHY" (total length 40 chars), This is what makes your personal ID as well (in my case it was "014{{unique-id}}" so this one is 43 characters)
3. Extract File Salt - Get 5-byte salt from the beginning of each file (first 5 bytes)
4. XOR Encrypt - Use master key + system ID + file salt to generate keystream, then XOR encrypt only the first ~150KB of each file
5. Add .djvu extension - document.pdf becomes document.pdf.djvu
6. Insert metadata - Adds the system ID and salt info to each file
7. Leave marker - Special Constant byte sequence to identify encrypted files

File structure after encryption:

[5-byte Salt]
[Encrypted Data] (~150KB)
[Original Data] (Remaining)
[40-byte System ID]
[Marker]

Why only partial encryption?

• Faster encryption process
• Files keep most original data intact
• Makes victims think files are "broken" not encrypted

Two types of system IDs:

1. Offline IDs - Can be decrypted if we have the keystream
2. Online IDs - Need the actual master key (usually impossible)

How decryption works step by step:

1. File Validation - Check for STOPDjvu marker bytes to confirm it's encrypted
2. Extract System ID - Get 40-char unique system ID from file footer (last 78 bytes)
3. Extract Salt - Get 5-byte salt from file header (first 5 bytes)
4. Find Matching Keystream - Look for keystream with matching system ID and salt:
   • First check local JSON files (api_keystreams.json, keystream_db.json)
   • If not found, query Emsisoft API
5. XOR Decryption - XOR the encrypted portion (first ~150KB) with the keystream to get original data
6. File Assembly - Combine decrypted header + original unencrypted tail data
7. Clean File - Remove ransomware footer/metadata to get identical original file

Files of the same type with the same file format version usually have the same salt ID. This means:

• If you extract a keystream from one file pair (original + encrypted)
• You can use that same keystream to decrypt other files having the same salt ID
• This is why one successful keystream extraction can help decrypt multiple files from the same system
• Example: All PDF files created by the same PDF software version on the same infected system will likely share the same salt
• So, if you have 1 original file for the each File-Salt-IDs then you can decrpt all your files

• file_test - Detect whether a file is encrypted by STOPDjvu and display extracted metadata (5‑byte salt, 40‑char system ID, marker) and keys for your system ID from emisoft if exists
• extract_keystream.py - Extract keystreams from original/encrypted file pairs
• compare_keystreams.py - Compare extracted keys with server keys
• decrypter.py - Main decrypter (reads local keys first, then tries API)

Extract keystreams from file pairs:

python extract_keystream.py ./original/ ./encrypted/

Decrypt single file:

python decrypter.py document.pdf.djvu

Decrypt entire directory:

python decrypter.py ./encrypted_files/ ./decrypted_files/

Use local keystream database:

python decrypter.py ./encrypted_files/ ./output/ --local-db keystream_db.json

• Based on Emsisoft's research and decryption logic: https://www.emsisoft.com/ransomware-decryption/stop-djvu/
  • More details: https://www.emsisoft.com/en/blog/34375/emsisoft-releases-new-decryptor-for-stop-djvu-ransomware/
• File pair uplaod site to generate keystreams: https://decrypter.emsisoft.com/submit/stopdjvu/
• Emisoft's STOPDjvu Decrypter tool to decrypt your files: https://www.emsisoft.com/en/ransomware-decryption/download/stop-djvu
  • How to use: https://www.emsisoft.com/en/ransomware-decryption/howtos/emsisoft_howto_stopdjvu.pdf