Ransom.Snatch.7 malicious file

The Ransom.Snatch.7 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Snatch.7 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Scheduled file move on reboot detected
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Creates an autorun.inf file
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Created a process from a suspicious location
• Writes a potential ransom message to disk
• CAPE detected the Snatch malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Creates a known Babuk ransomware decryption instruction / key file.
• Uses suspicious command line tools or Windows utilities

How to determine Ransom.Snatch.7?

File Info:
name: FC9C246B74D51E30B023.mlw
path: /opt/CAPEv2/storage/binaries/da7a483322df7078a0f5d209342cf52362909cd8e16d17e28830157640336801
crc32: 530119C1
md5: fc9c246b74d51e30b023773f65de047c
sha1: fe7dd3e9980487d215a960a05047f579198fe0de
sha256: da7a483322df7078a0f5d209342cf52362909cd8e16d17e28830157640336801
sha512: 53e897d8733ae9b2cf31a37deb76583871a7266e02f4f1d779dbcef238bfe0f067087982944702dfc95780b45b6f4c1e00032f5c81bca392b4f7e6538be73236
ssdeep: 49152:Ng3X166y/EGOKix0qos6cczpB4g5HVGaM3YG5jdBbzxD0jVrWfRHZ0v41wssjZ/v:m86/XKvs6ccgg5HVGaMF7B3F0jVwRHZM
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T128C533E62013704AFE911EF8F70CB6E442813423AADA387C1ED7C5D9583A8F5CADA557
sha3_384: cdf0b65b240ba6183202ed645664146da490b9d7c89ee5e42d623d1cac8b12f6ce08c65825152792bca1dbca9afa151b
ep_bytes: 53565755488d35fa4bd9ff488dbedb8f
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Ransom.Snatch.7 also known as:

How to remove Ransom.Snatch.7?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.