GT500

Most information about Snatch is over a year old at this point. No one has ever found a way to decrypt files it has encrypted. You'll find the same in the discussion about it on BleepingComputer's forums (the conversation may seem a bit confusing since multiple topics were merged into one):
https://www.bleepingcomputer.com/forums/t/702782/snatch-ransomware-support-help-topic-decrypt-extension-datatxt/

10 hours ago, DandanDz12 said:

Any news for this offline ID?

oO7OVYUyivYvPEI6nuQIcKXNx74ml0mkowpmDzt1

It doesn't look like we have the private key for it yet.

Just run the decrypter once every week or two, and when we do have the private key it will start decrypting your files.

This is a newer variant of STOP/Djvu. If you have an offline ID, then once we can find the decryption key for this variant and add it to our database you should be able to recover your files. However, if you have an online ID (which is more likely) then it will not be possible to recover your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

This is a newer variant of STOP/Djvu. If you have an offline ID, then once we can find the decryption key for this variant and add it to our database you should be able to recover your files. However, if you have an online ID (which is more likely) then it will not be possible to recover your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

11 hours ago, hamedn53 said:

What if I send you the pair files to analyze-lab? (We're ready paying for analyzing and decrypting)

Would that make any differences on decrypting the ransomware-encrypted-online-id?

That won't help. Newer variants use RSA encryption, which isn't vulnerable to most forms of attacks. It would take even a supercomputer thousands of years to brute force the private key for decryption.

You're welcome.

16 hours ago, shrikant dudhal said:

Your personal ID:
0267OrjkrEHkjsG2HlRPG3YK4W8BFBYU9wMW4R5Uznmf3l0r

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

16 hours ago, Magdana said:

Did you manage to prepare the decrypter?

The decrypter hasn't been updated in quite some time, and when we do update it we only do so to fix bugs.

That detection looks accurate, and ID Ransomware is correct that there is no known way to decrypt files.

20 hours ago, Haresh said:

Can we expect decryption for STOP/Djvu online key, the new variant from EMSISOFT?

If law enforcement is able to catch the criminals or otherwise gain access to their servers and release their private keys for use in decrypters, then we can add them to our database so that everyone can get their files back.

22 hours ago, paresh_16apr said:

Your personal ID:
0264ergaYleXeOTkoqtZnuc7kfFQFvJb8ZCXf47mrxUJPFX6

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

This may be FonixCrypter, however I still recommend uploading a copy of the ransom note along with an encrypted file to ID Ransomware so that you can be certain which ransomware it is:
https://id-ransomware.malwarehunterteam.com/

You can paste a link to the results into a reply if you would like for me to review them.

8 hours ago, hamedn53 said:

.weui Ransomware - Online Id :: 0268AsdtX9LkFd5OJPfFLWzb9vriXbyAL06zdBWVn2WT90TA

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

On 1/2/2021 at 5:49 AM, Harshit said:

Yes .weui present end of file name

OK, the fact that your ID is an offline ID is good, however we don't yet have the private key for it. I recommend running the decrypter once every week or two so that you can see when we've been able to add the private key for your variant.

There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

10 hours ago, Kos said:

Your personal ID:
0274aSjeefrBH3bVGeebJ25AEGAITO8cLLer1d06dATWRzgKj

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

On 1/3/2021 at 4:30 PM, Miran Baloch said:

No key for New Variant online ID: ylvAzpthhX5bEF4Du9se62XxBGQUQW3tz5E1D2Nv
Notice: this ID appears to be an online ID, decryption is impossible

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

On 1/2/2021 at 5:03 PM, nir uzan said:

How can i know when u update the software descryptor ?

We recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters:
https://www.bleepingcomputer.com/

If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news:
https://www.bleepingcomputer.com/feed/

14 hours ago, tuanton said:

Does the extension come with the product download

If you use Google Chrome, Mozilla Firefox, or Microsoft Edge then you will be asked if you want to install the extension when you launch your web browser. Selecting to install it should open the extension page in your web browser where you can read the description, see screenshots, and click the button to add it to your web browser.

There is more information about how the extension works, and links to where to obtain it for each browser, at the following link:
https://help.emsisoft.com/en/1974/emsisoft-browser-security/

6 hours ago, ITCARE said:

C:\Windows\Temp\tmp00000268\tmp000684bc

That looks like the sort of path BitDefender's scan engine uses when extracting the contents of archives during a scan. I recommend checking to see if Emsisoft Anti-Malware was running a scan at the time, and if you can try to verify what archive it was extracting at the time. You may need to run the scan manually on a machine where you are seeing these detections in order to identify which file is being scanned when these detections occur.

Note that if Emsisoft Anti-Malware is configured to scan inside mail archives, the BitDefender engine will extract those to the TEMP folder as well.

An alternative is to disable whatever other protection is on the workstations where this is happening to see if Emsisoft Anti-Malware detects the files rather than the other software. If it does detect them, then that will make it easier for you to identify which archive contains the files being detected. If it doesn't detect them, then that could indicate a false positive on the part of the other software that's detection them.

This is a newer variant of STOP/Djvu. If you have an offline ID, then once we can find the decryption key for this variant and add it to our database you should be able to recover your files. However, if you have an online ID (which is more likely) then it will not be possible to recover your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

22 hours ago, abror said:

No key for New Variant online ID: vRYbxXssDKrONrsSTivwhKZgKwn4Ao1xPpysnNji
Notice: this ID appears to be an online ID, decryption is impossible

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

11 hours ago, mferrap said:

No key for New Variant online ID: guSO4GjsgB9Ga62QXbBtIRIsV4CjSMOcjs90mR6u
Notice: this ID appears to be an online ID, decryption is impossible

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

15 hours ago, Utkarsh said:

Can there be an key available in future?

If emsisoft finds it?

If law enforcement is able to catch the criminals or otherwise gain access to their servers and release their private keys for use in decrypters, then we can add them to our database so that everyone can get their files back.

10 hours ago, Akssel said:

No key for New Variant online ID: DE8ADnV8LUx7e5KYh8u0qg96Yw8dAHbQ2aN7oRr7
Notice: this ID appears to be an online ID, decryption is impossible

That's an online ID. Your files aren't decryptable.

14 hours ago, Indir said:

i have offline ID

We don't have the private key for .COPA's offline ID yet, so just run the decrypter once every week or two and once we're able to get it and add it to our database the decrypter should start decrypting your files.