HavanaCrypt Ransomware Masquerades as a Fake Google Update

A new ransomware family dubbed ‘HavanaCrypt’ disguises itself as a Google program update app, applying a Microsoft web hosting provider IP tackle as its command and management server to circumvent detection.

Specific by security researchers at Trend Micro in a report, the ransomware is the most recent in a series of malware that poses as a respectable software. This yr on your own has viewed ransomware masquerading as Windows 10, Google Chrome and Microsoft Trade updates. 

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The HavanaCrypt ransomware family members in-depth by Pattern Micro is equivalent in its aims: “It disguises by itself as a Google program update application and utilizes a Microsoft web hosting service IP tackle as its command and handle server to circumvent detection,” Craze Micro reported in a blog.

The malware can check if it is functioning in a virtualized setting and will terminate itself if that is the circumstance. Development Micro described how it essential to use resources such as de4dot and DeObfuscar to assess the sample and make the deobfuscated code.

Trend Micro’s investigation confirmed how the ransomware uses the QueueUserWorkItem function, a .NET System.Threading namespace technique to speed up encryption, as nicely as the modules of open-resource password manager KeePass Password Safe during its file encryption program.

HavanaCrypt avoids encrypting information in quite a few directories, like Tor. Using this into account, it is “highly possible” that the ransomware’s author is planning to talk by means of the Tor browser, Craze Micro scientists stated. 

In addition, the scientists pointed out that HavanaCrypt does not drop a ransom notice. “This may possibly be an indicator that HavanaCrypt is nonetheless in its growth section,” they claimed. “Nevertheless, it is significant to detect and block it in advance of it evolves more and does even much more destruction.”

“Ransomware teams are turning up tension on their victims,” stated Bharat Mistry, specialized director at Craze Micro. “The amount of sophistication employed by legal gangs is exponentially raising and basically relying on user recognition teaching and endpoint defenses is no extended sufficient.”  

Nevertheless whilst this is a new form of ransomware, it is shipped by way of standard social engineering procedures, stated Javvad Malik, direct security recognition advocate at KnowBe4. “It’s crucial for persons to be conscious of what software they down load and the source. When in question, updates ought to be still left to both the IT staff to administer or downloaded by means of the official channels.”