LQTOREQ Ransomware: Technical Breakdown & Manual Removal Guide

LQTOREQ is a recent variant of the STOP/Djvu ransomware family — by infection volume, the most prolific consumer-targeting ransomware operation in existence. STOP/Djvu has run continuously since late 2018, releasing a new variant on a near-weekly schedule, each distinguished by a four- to seven-letter extension appended to encrypted files. LQTOREQ files carry the .lqtoreq extension, and the operators drop a ransom note named _readme.txt in every folder they touch.

This article walks through what LQTOREQ does technically — how it gets onto a machine, how it encrypts files using Salsa20 wrapped in an RSA-2048 key envelope, what artifacts it leaves on disk and in the registry, and how to remove it manually. It also covers the single most important question for any STOP/Djvu victim: were your files encrypted with an online key or an offline key? That answer determines whether free decryption is possible at all.

Threat Profile at a Glance

Why "LQTOREQ" Is Really a STOP/Djvu Problem

LQTOREQ is not an independent ransomware family — it is one extension in a long-running production line. The same actor (or small group of actors) has been releasing variants of STOP/Djvu since December 2018, each with a fresh extension chosen seemingly at random. Earlier extensions include .djvu, .djvuu, .tro, .rumba, .promo, .adobe, .boop, .kasp, .opqz, .coza — and dozens more. By extension count alone, STOP/Djvu accounts for the largest share of ransomware infections reported worldwide on platforms like ID Ransomware and BleepingComputer's support forum.

Operationally, all STOP/Djvu variants share the same codebase. They differ in three small ways:

• The file extension appended to encrypted files (e.g. .lqtoreq)
• The hardcoded RSA-2048 public key used for online-key mode
• The hardcoded Salsa20 offline key (the same for every victim of that one variant)

This matters because the decryption tooling situation depends on which variant you have. Emsisoft's STOP Decryptor can recover files from any STOP/Djvu variant — but only if the file was encrypted with the variant's offline key, AND a victim of that same variant has paid the ransom and shared the recovered key with the researcher community. The decryptor has unlocked ~150 of the ~700 known STOP/Djvu variants. New variants like LQTOREQ start with no recovered keys and are progressively added as keys become available.

How LQTOREQ Gets Onto a Machine

LQTOREQ infections almost always trace back to one specific user action: downloading and running pirated software. The STOP/Djvu operators do not run phishing campaigns, do not exploit unpatched Windows services, and do not use compromised RDP. They distribute through fake software-crack sites and "free" download portals that have been a fixture of search results for years.

The crack-site infection chain

A typical infection chain looks like this:

1. User searches for "[software-name] crack", "[game] activator", "KMSpico Windows 11", or a similar term.
2. One of the top search results is a blog-style page hosting a download link, often promising the activator in a password-protected ZIP file.
3. The ZIP contains a "Setup.exe" or "Activator.exe" plus a README with the unzip password — passwording the archive is what defeats most antivirus engines, which cannot scan inside encrypted ZIPs.
4. When the user unzips and runs the executable, three things happen nearly simultaneously: an info-stealer (RedLine or Vidar) is dropped to harvest browser-saved passwords, the LQTOREQ payload is installed, and encryption begins.

Technical Execution: What Happens on First Run

When the LQTOREQ executable runs, it performs a deterministic sequence of operations. Each step has been refined across hundreds of STOP/Djvu variants — the code is mature, defensive, and built specifically for evasion on consumer Windows installations.

Step 1 — Self-installation and persistence

The malware generates a random UUID-style folder name and copies itself into %LocalAppData%:

Both persistence locations need to be removed during cleanup — the scheduled task is the more commonly overlooked one, and it will re-launch the binary on every hourly tick if left in place.

Step 2 — UAC bypass via the CMSTP technique

To execute privileged commands (like vssadmin delete shadows), LQTOREQ uses a well-known UAC bypass abusing CMSTPLUA COM elevation. It instantiates the auto-elevated CMSTPLUA COM object via CoCreateInstance, then uses its methods to execute arbitrary commands at high integrity without showing a UAC prompt. This trick has been documented since 2017 and has been used by dozens of malware families; Microsoft has chosen not to patch it because doing so would break legitimate Connection Manager profile installs.

Step 3 — Personal ID generation

The malware reads the MAC address of the primary network adapter, MD5-hashes it, and writes the resulting hex string to a fixed location — this becomes the victim's "Personal ID":

The last two characters of the Personal ID are the single most important diagnostic in any STOP/Djvu case. A trailing t1 means the C2 was reachable and a unique online key was issued — recovery without the criminals' cooperation is mathematically infeasible. A trailing t2 means the C2 was unreachable and the hardcoded offline key was used — recovery is possible if a researcher has obtained that variant's offline key.

Step 4 — Hosts file modification

To prevent security software from updating, contacting telemetry servers, or downloading new signatures, the malware appends a long block of entries to the Windows hosts file:

This is the reason that, immediately after infection, you may find you cannot reach any antivirus vendor's site or download a removal tool. The hosts file must be cleaned (covered in the removal steps below) before any browser-based recovery work will function.

Step 5 — Shadow Copy deletion

With elevation acquired via the CMSTP trick, the malware issues:

This is a near-universal step across modern ransomware. By the time you see the ransom note, shadow copies are gone.

How LQTOREQ Encrypts Files

LQTOREQ uses a hybrid encryption scheme: Salsa20 as the bulk-data cipher and RSA-2048 as the key-wrap algorithm. Salsa20 is a fast stream cipher; RSA-2048 ensures the per-file Salsa20 keys can only be unwrapped with the operators' private key.

The online vs. offline key fork

Here is the part that is unique to STOP/Djvu and that decides every recovery outcome:

This design quirk is the reason Emsisoft's STOP Decryptor exists. When a victim pays the ransom, they receive the decryption key for their infection. If they were in offline-key mode, that single key decrypts every other offline-key victim of the same variant. Several of those keys have been shared with researchers over the years, populating the decryptor.

Per-file encryption process

For each targeted file, LQTOREQ executes the following:

1. Open the file and read its first 150 KB.
2. Generate (or retrieve from binary) a 32-byte Salsa20 key and an 8-byte nonce.
3. Encrypt that 150 KB chunk in place using Salsa20.
4. Append an end-of-file marker block containing the Salsa20 key wrapped with the victim's RSA-2048 public key, plus a flag indicating online vs offline mode and the variant's Personal ID.
5. Rename the file by appending .lqtoreq to the existing name (e.g. budget.xlsx → budget.xlsx.lqtoreq).

The 150 KB partial-encryption trick is a performance optimization — it lets the ransomware finish encrypting a victim's entire user-document tree in minutes rather than hours, while still rendering most file formats unopenable because the file header (containing magic bytes, indexes, and metadata) sits within those first 150 KB. For text files and small documents (under 150 KB), the entire file is encrypted.

What file types are targeted

The hardcoded extension list covers everything a typical home user would care about — documents, photos, music, videos, archives, and project files. Executables, DLLs, system files, and the contents of Windows\ and Program Files\ are explicitly skipped (encrypting them would brick the OS and prevent payment).

The ransom note

After encryption finishes, the malware drops a file named _readme.txt in every directory containing encrypted files, plus once on the desktop. The contents are nearly identical across STOP/Djvu variants:

Artifacts LQTOREQ Leaves Behind

If you are doing a manual cleanup, these are the locations to check and clear in order. Every item below is created or modified by LQTOREQ during a typical infection:

Manual Removal: Step-by-Step

The order of operations here matters. Removing the malware does not decrypt your files — that is a separate process covered in the next section. Do every step here first to stop further damage and break persistence, then move to recovery.

File Recovery Options

Removing the malware stops new damage. To get your files back, you have these options — in order of likelihood:

Option 1 — Restore from backup (best outcome)

If you have a recent backup on an external drive that was not connected during the infection, on a NAS that wasn't a mapped Windows share, on a versioned cloud service (Backblaze, Carbonite, Time Machine via SMB, OneDrive's Version History, Google Drive's "Restore previous versions"), restore from it after confirming the machine is clean. Restoring onto an active infection will re-encrypt the restored files immediately.

Option 2 — Emsisoft STOP Decryptor

Emsisoft maintains a free decryptor for STOP/Djvu at emsisoft.com/ransomware-decryption-tools/stop-djvu. The tool will:

• Identify your variant from a sample encrypted file
• Determine whether you were encrypted with an online or offline key (the t1 / t2 suffix in your Personal ID)
• If offline-key mode and Emsisoft has obtained that variant's offline key from a previous victim or research collaboration, decrypt all your files at no cost
• If online-key mode, report that decryption is not currently possible — your files will need to wait for a key leak or law-enforcement seizure of the operators' infrastructure

For a brand-new variant like LQTOREQ, the offline key may not yet be in Emsisoft's database. Run the tool monthly — they add keys as they obtain them.

Option 3 — ID Ransomware

Before any other tool, run your files through id-ransomware.malwarehunterteam.com. Upload a sample encrypted file and a copy of _readme.txt. The site will confirm the family (STOP/Djvu), the specific variant (LQTOREQ), and link you to the appropriate decryptor if one exists. It is the canonical first-stop diagnostic.

Option 4 — NoMoreRansom.org

The No More Ransom project — run by Europol, the Dutch National Police, and dozens of private-sector partners — aggregates decryptors for hundreds of ransomware families. Use the "Crypto Sheriff" tool there as a cross-check against Emsisoft.

Option 5 — Recuva or PhotoRec (long shot)

LQTOREQ encrypts files in place but does so by reading the file, computing the ciphertext, and writing it back. In some edge cases — particularly with photos and other large files in user folders — Windows briefly stages the operation through a temporary file, and the original allocation is freed without being overwritten. File-recovery tools like Recuva (free) and PhotoRec (free, more thorough) can occasionally recover those un-overwritten originals from the disk's free space. The success rate is low but non-zero — worth trying for irreplaceable personal photos before declaring loss.

Option 6 — Professional data recovery

For business-critical data with no working backup, a professional data-recovery lab can sometimes pull plaintext fragments from unallocated sectors. This is expensive ($500–$3,000+), not guaranteed, and only worth doing for data whose value clearly exceeds the cost.

Option 7 — Accept loss; preserve the encrypted files

If none of the above produce results, the right move is to preserve a backup copy of all the encrypted .lqtoreq files on an external drive, wipe the infected machine, and reinstall Windows fresh. Keep those encrypted files indefinitely. STOP/Djvu operators have been arrested before; law enforcement has seized servers before; Emsisoft adds offline keys to the decryptor years after the variant first appeared. Files unrecoverable today may be recoverable next year.

Prevention

STOP/Djvu specifically targets users who download pirated software. The single most effective prevention is to stop doing that. After that:

1. Maintain offline backups using the 3-2-1 rule. Three copies, two media types, one offsite or disconnected. A backup connected to the PC at the moment of infection will be encrypted with everything else.
2. Show file extensions in Windows Explorer. View → Show → File name extensions. Lets you spot disguised executables.
3. Block executables from running in user-writable directories. A Software Restriction Policy or AppLocker rule preventing .exe execution from %LocalAppData%, %AppData%, and %Temp% would have stopped every STOP/Djvu infection in its tracks. This is a free Windows feature; most people simply never enable it.
4. Keep Windows Defender on, and updated. Defender recognizes most STOP/Djvu droppers within hours of their release. Disabling it to run a "crack" is what enables the infection.
5. Use a password manager with a master password, not browser-saved passwords. Browser-saved passwords are the first thing RedLine and Vidar exfiltrate. A separate, encrypted password manager that requires its own master password is dramatically more resistant.
6. Enable two-factor authentication on email, banking, and cloud accounts. Stolen passwords are useless to attackers if there's a second factor blocking login.
7. Buy your software. The combined cost of every "free" version of Photoshop, Office, and Windows that someone might pirate over a lifetime is less than one professional data-recovery attempt — and orders of magnitude less than the value of the data lost to a single ransomware infection.

Bring Your Device to Computer Repair Roswell

STOP/Djvu cleanup is one of the more demanding jobs we do — not because the malware is hard to remove (it is not), but because the recovery path requires careful triage: identifying the exact variant, determining the key mode, preserving the encrypted files for future decryption, hunting down the info-stealer that came along with it, and helping the customer rotate every credential that was on the machine.

If you are looking at .lqtoreq files right now, do four things before you bring the machine in: power it off, do not connect any USB drives to it, write down any passwords or accounts you used on it, and call us. We will handle the rest.

Our shop is in Roswell and serves all of North Atlanta — Alpharetta, Sandy Springs, Marietta, Johns Creek, Milton, Dunwoody, and beyond. Walk-ins welcome, or submit a repair request below and we'll respond within the hour.