HavanaCrypt ransomware poses as a Google software update app

A new report by security researchers at Trend Micro revealed that a new ransomware family known as HavanaCrypt uses a Microsoft web hosting service IP address as its command and control server to evade detection by disguising itself as a Google software update app.

 

The ransomware is the most recent in a line of malware that impersonates a legitimate application. The report said that this year alone witnessed several ransomware impersonating Microsoft Exchange, Google Chrome, and Windows 10 updates.

 

The HavanaCrypt ransomware family described by Trend Micro shares some of the same objectives; to avoid detection, it poses as a Google software update application and uses an IP address from a Microsoft web hosting service as its command and control server, according to Trend Micro’s blog.

 

The malware can determine whether it is running in a virtualized environment and will shut down automatically if it is. To analyze the sample and produce the deobfuscated code, Trend Micro explained how it needed to use programs like de4dot and DeObfuscar.

 

Trend Micro’s investigation results revealed the ransomware’s use of the.NET System function QueueUserWorkItem. The open-source password manager KeePass Password Safe uses a threading namespace method to speed up encryption, as do some of its modules.

 

HavanaCrypt does not encrypt any files in Tor or other directories. Given this, Trend Micro researchers said it is "highly possible" that the ransomware’s creator intends to communicate using the Tor browser.

 

The researchers also noted that HavanaCrypt does not leave a ransom note behind. They claimed that this might suggest that HavanaCrypt is still in the early stages of development. But before it develops further and causes more harm, it’s critical to find and stop it.

 

Bharat Mistry, technical director at Trend Micro, said that the pressure from ransomware groups on their victims is increasing. Criminal gangs are using technology that is exponentially becoming more sophisticated. He claimed that relying on endpoint defenses and user awareness training is no longer sufficient.