Hey you,

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:

7ev3n-HONE$T Virus – The Return of the Ransomware

STF-7ev3n-hone$t-honest-ransomware-virus- ransom-note-screen-message

7ev3n ransomware has been updated with a brand-new variant. Now it bears the name 7ev3n-HONE$T and asks less money for payment. To remove this virus and see how you can try to decrypt your files, you should read the article to its end.

The ransomware again encrypts files by adding the .r5a extension to them. Ransom instructions for paying are also updated, and there is an option to give only half the sum for half of your files back.

Threat Summary

Name 7ev3n-HONE$T
Type Ransomware
Short Description The ransomware encrypts files and demands less money for their decryption than before.
Symptoms Files are encrypted with the previous extension of the ransomware – .r5a. There are new instructions, which include promotions to try to make users pay up.
Distribution Method Spam Emails, Email Attachments, File Sharing Networks
Detection Tool See If Your System Has Been Affected by 7ev3n-HONE$T


Malware Removal Tool

User Experience Join Our Forum to Discuss 7ev3n-HONE$T.

7ev3n-HONE$T Ransomware – Spread

The 7ev3n-HONE$T ransomware could spread via few ways. Probably the most effective of these ways is by using spam emails that have malicious attachments. Opening the attachment will infect your computer. Malware code may be inside the email’s body, and just opening the email might be enough to get infected.

The virus might spread through other ways, such as social media and file sharing networks. They might distribute 7ev3n-HONE$T with attachments and files. The files or attachments can hide the virus, but pretend to be useful. Do not click on anything, especially if you have landed on an untrusted website.

7ev3n-HONE$T Ransomware – More Information

7ev3n-HONE$T is the new name of the ransomware virus. You can read about its past variant – 7ev3n Ransomware. If your computer got infected with it, the virus will try to evade detection and hide as some other program. The initial variant of this ransomware used the following names:

  • UAC.exe
  • A13-1.exe
  • System.exe

The latest update might try to disguise itself as other processes. To boot everytime the Windows OS loads, the ransomware makes two registry values in the Windows Registry. As before they are both connected with the System.exe file, although other process names might be at play as well. The registry entries are the following:




7ev3n-HONE$T will create multiple copies of the text file with the ransom note, much like its predecessor.

This is a warning message that appears on your screen:

STF-7ev3n-hone$t-honest-ransomware-virus- ransom-note-screen-message

Here is what the newer ransom warning message states:

All your photos, media, documents, databases, MS Office and other important files were encrypted with strong algorithm.
References as an aid to take correct decision: (click on the link for opening)

Decryption price 1.0 bitcoin (400 USD)
Unique bitcoin address for payment was generated only for you:
File decryption process is completely automated! The process is “PAY – DECRYPT”.
1. The list of encrypted files are available by click on “VIEW”.
2. You are able to decrypt 3-5 files free of charge. The choice is random. Therefor click on “TEST DECRYPT”.
3. You are able to decrypt the half (50%) of the files, therefor pay 0.6 BTC (240 USD) to unique address specified above the program will randomly choose the half of the files and decrypt them. Since then you can pay additional 0.6 BTC (240 USD) and the program will decrypt the rest of the files. If you pay the total amount (1.0) at one you get 20% discount.
4. Confirmation of one transaction takes 30 minutes or less. The process of files decryption and self-deleting is automated. Decryption process takes 1-3 hours based on the amount of encrypted files, decryption speed is 7 Gb / hr.
5. To get keys and start decrypting process after payment, please ensure that your internet-connection is active!
6. If you don’t know that are bitcoins, how to purchase and use them click on “How to Pay”.

Don’t try to delete the program, any delete actions will be resulted in irrecoverable loss of your files. Don’t try to change file names and their extensions. Don’t enable Antivirus of Firewall software. The only way to recover access to your files is to pay for decryption process. Encryption algorithm is invincible. There are no third programs for this algorithm decryption and there would not be any.

Attention! you have to pay within 72 hours. If the payment is not performed, private key will be destroyed and files will be lost.

7ev3n-HONE$T ransomware will search for files to encrypt. Here are some of the file extensions it can encrypt:

→.jpg, .js, .mdb, .odt, .pdf, .doc, .txt, .xls, .xlsx, .xml, .docx, .html, .php, .png, .ppt, .pptx, .sql

Surely, there are more files the ransomware can encrypt. The file extension that is appended to all encrypted files is once more .r5a.

The 7ev3n-HONE$T ransomware creators try to be honest as the new sum for paying the ransom is just 1 BitCoin or 400 dollars. And that’s the preferable sum for most modern ransomware types. There are promotions for you to pay a bit more than half the money ($240) for half of your files unlocked, or paying the full sum within the first 72 hours and getting a 20% off ($300 total).

We advise NOT to pay the ransom as nothing can serve as a guarantee that you will get your files back or even if the virus makers will contact you back.

Shadow Volume Copies may also be erased from the Windows operating system. So, after removing this virus, you should see the 3rd section of the instructions guide provided below to see how you can try to restore your files.

Remove 7ev3n-HONE$T Ransomware and Restore .r5a Encrypted Files

If you got infected by the 7ev3n-HONE$T virus, you should have a little bit of experience in removing malware. The virus could keep spreading and continue to lock more files, so it is recommended for you to follow the step-by-step instructions below:

Manually delete 7ev3n-HONE$T from your computer

Note! Substantial notification about the 7ev3n-HONE$T threat: Manual removal of 7ev3n-HONE$T requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove 7ev3n-HONE$T files and objects.
2. Find malicious files created by 7ev3n-HONE$T on your PC.
3. Fix registry entries created by 7ev3n-HONE$T on your PC.

Automatically remove 7ev3n-HONE$T by downloading an advanced anti-malware program

1. Remove 7ev3n-HONE$T with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by 7ev3n-HONE$T in the future
3. Restore files encrypted by 7ev3n-HONE$T
Optional: Using Alternative Anti-Malware Tools

Berta Bilbao

Berta is the Editor-in-Chief of SensorsTechForum. She is a dedicated malware researcher, dreaming for a more secure cyber space.

More Posts - Website

Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.