---
id: 7411
title: "Snatch Ransomware khởi động lại Windows ở chế độ Safe Mode để vượt qua Anti-Virus"
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/snatch-ransomware-khoi-dong-lai-windows-o-che-do-safe-mode-de-vuot-qua-anti-virus/"
published_at: "2020-01-06T10:55:00Z"
tags: ["ransomware", "windows", "evasion", "data-theft", "snatch", "safe-mode"]
phying_url: "https://phying.com/item/7411"
lang: en
---

# Snatch Ransomware khởi động lại Windows ở chế độ Safe Mode để vượt qua Anti-Virus

## Summary

The Snatch ransomware reboots infected Windows machines into Safe Mode, where most third-party antivirus cannot run, then encrypts files and wipes shadow copies; it also exfiltrates data.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **Published:** 2020-01-06T10:55:00Z
- **Original:** https://blog.viettelcybersecurity.com/snatch-ransomware-khoi-dong-lai-windows-o-che-do-safe-mode-de-vuot-qua-anti-virus/
- **Phying News:** https://phying.com/item/7411