BananaCrypt Ransomware

The BananaCrypt Ransomware is a file-locking Trojan that holds your media hostage by using the AES encryption to stop it from opening. The Trojan asks you to pay Bitcoins for recovering the decryption key that allows you to unlock any files. Ransom-based solutions to threatening encryption attacks always should be left for last resorts, and most anti-malware products should be able to delete the BananaCrypt Ransomware upon its detection safely.

Trojans Making Critical Mistakes in Their Terminology

As threat actors continue using free translation utilities for overcoming language barriers, there arises an increasing likelihood of file-locking Trojans employing confusing or inappropriate ransom notes. This unclear communication operates counter to the goals of the con artists, who want to convey their demands clearly and succinctly. However, for a low-level campaign like that of the BananaCrypt Ransomware, the trade-off is minor.

The BananaCrypt Ransomware is a work-in-progress showing several signs of being an incomplete program but does include an encryption-based attack that can lock the files of its victims, much like the payloads of relatively polished projects like the Jigsaw Ransomware or the Globe Ransomware. Malware analysts ascertain that the BananaCrypt Ransomware is using an AES-based cryptography routine that should be decryptable by appropriate cyber-security experts, although any patch to the Trojan could make this conclusion outdated.

The Trojan also uses Notepad files for profiting off of this file-locking feature, by selling its decryption key. However, the message includes a critical error that misstates the original attack as being a 'decryption,' instead of encryption, which reverses the intended meaning of the warning and may confuse any victims without much knowledge of file-locking threats. Although malware analysts find no other, equally mention-worthy mistakes, the BananaCrypt Ransomware is using placeholder information for its Bitcoin-paying address and demands the equivalent of 300 USD value without offering any direct link to the decryption mechanism.

Protecting Your Files from a Rotten Fruit's Spoilage

The BananaCrypt Ransomware is independent of previous families of file-locker Trojans like Hidden Tear and requires a custom decryption application for the unlocking of any files. Users who need to unlock their media can contact any reputable PC security researcher with experience in cryptography, who should be able to restore the media with limited issues. However, assuming that current decryption solutions always will be relevant to an in-development threat like the BananaCrypt Ransomware is an assumption that malware experts warn against indulging in, especially when secure backups can furnish better recovery options.

The infection strategies of file-locking campaigns are flexible, but e-mail attachments are the preference of threat actors attacking government and business sector entities. Casual users are more likely of endangering themselves by downloading illicit files or browsing corrupted websites hosting any of several drive-by-download exploits. Anti-malware products of various brands can eliminate the BananaCrypt Ransomware after a security breach or even prevent its installation and the accompanying damage to your data.

With all the errors, temporary information and incorrect assertions in its message, there's no reason to take the BananaCrypt Ransomware at its word. Always remember that a program's honesty is no better than that of the entity behind its programming; Black Hat software is, accordingly, no more trustworthy than a con artist.