Stop ransomware spreads through cracked games, with thousands of infections per day

Feb 27, 2020kate
Learn more about 360 Total Security

Recently, 360 Security Center has detected that the number of infected users of stop ransomware continues to increase. After traceability analysis, it has been found that stop ransomware spreads through various cracked games. Taking the GTA4 cracked version as an example, the infection process is shown in the following figure:

Technical Analysis

The latest stop ransomware uses a variety of common code obfuscation techniques to combat the anti-virus sandbox, such as using meaningless system function calls to combat some anti-virus virtual machines:

Oversized invalid loop body, avoiding some virtual machines with timeout options:

After running all the obfuscation logic, the stop ransomware will be decrypted and executed in memory:

The decrypted stop ransomware debugging path is as follows:

Stop ransomware encrypts user files and asks for ransom. The ransomware prompts are as follows:

For the analysis of stop ransomware encryption logic, please refer to

Security advice

(1) Do not use cracking software, games, etc. of unknown security.

(2) 360 Total Security can detect and block such attacks in a timely manner. It is recommended that users go to to install and kill.

Learn more about 360 Total Security