What is “Generic.Ransom.Snatch.D17E29F1”?

The Generic.Ransom.Snatch.D17E29F1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Generic.Ransom.Snatch.D17E29F1 virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Generic.Ransom.Snatch.D17E29F1?


File Info:
name: C99BABFA4C229807118A.mlw
path: /opt/CAPEv2/storage/binaries/4091bed4ab832e97a152e6620184ec862bbba002442ee3e7679721f7625583ab
crc32: EAF9332F
md5: c99babfa4c229807118aaaddb121fa3d
sha1: 53da4fc222cbffd30016f0fa52406631ff23c46f
sha256: 4091bed4ab832e97a152e6620184ec862bbba002442ee3e7679721f7625583ab
sha512: 75d763fbd34b4bd576bbfc05796ba120d0d2c91db094c11660db0a8d8df698b15facb5de535a2f21e4458479612d7ceed1fc64ba06153bc5b5d4c3ecf7a1f790
ssdeep: 49152:H3sy3ZeQCIc1q62EyAlvE9Sgm/7FWCzeHtuY/zwRtbrqtR30QfROv0Gx4Bg2Gr+U:H3saXG1q64CzwuXtn8yT+H3XXrAj5HG
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T13A462840F9DB84F5EA0314314467E2BF27307D098B24DBC7EA947F6AE877A920D36619
sha3_384: 8aa9166c7923425842199802e04f84c6d0ec2dd5daba96ed59d3c417608a4742b7333c90f02b7994ce7145fa6ee95d7d
ep_bytes: e95bddffffcccccccccccccccccccccc
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Generic.Ransom.Snatch.D17E29F1 also known as:

MicroWorld-eScan	Generic.Ransom.Snatch.D17E29F1
ALYac	Generic.Ransom.Snatch.D17E29F1
Cybereason	malicious.a4c229
BitDefenderTheta	Gen:NN.ZexaF.36196.@FW@aifCATdi
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win64/Filecoder.BA
APEX	Malicious
Kaspersky	HEUR:Trojan-Ransom.Win32.Generic
BitDefender	Generic.Ransom.Snatch.D17E29F1
Avast	Win32:Evo-gen [Trj]
Emsisoft	Generic.Ransom.Snatch.D17E29F1 (B)
VIPRE	Generic.Ransom.Snatch.D17E29F1
McAfee-GW-Edition	BehavesLike.Win32.Jeefo.th
FireEye	Generic.Ransom.Snatch.D17E29F1
Sophos	Troj/GoRnsm-G
GData	Generic.Ransom.Snatch.D17E29F1
MAX	malware (ai score=80)
Arcabit	Generic.Ransom.Snatch.D17E29F1
ZoneAlarm	HEUR:Trojan-Ransom.Win32.Generic
Microsoft	Ransom:Win32/Gocrypt.YA!MTB
Google	Detected
AhnLab-V3	Malware/Win32.Generic.C4280792
VBA32	suspected of Trojan.Downloader.gen
Malwarebytes	Ransom.FileCryptor
Panda	Trj/Genetic.gen
Rising	Trojan.Generic@AI.100 (RDML:84E6Tyxd9gc5FyQ8RfXtkw)
Fortinet	W32/Filecoder.62F1!tr.ransom
AVG	Win32:Evo-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Generic.Ransom.Snatch.D17E29F1?

Generic.Ransom.Snatch.D17E29F1 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X