7ev3n-HONE$T Virus – The Return of the Ransomware - How to, Technology and PC Security Forum | SensorsTechForum.com

7ev3n-HONE$T Virus – The Return of the Ransomware

STF-7ev3n-hone$t-honest-ransomware-virus- ransom-note-screen-message

7ev3n ransomware has been updated with a brand-new variant. Now it bears the name 7ev3n-HONE$T and asks less money for payment. To remove this virus and see how you can try to decrypt your files, you should read the article to its end.

The ransomware again encrypts files by adding the .r5a extension to them. Ransom instructions for paying are also updated, and there is an option to give only half the sum for half of your files back.

Threat Summary

Short DescriptionThe ransomware encrypts files and demands less money for their decryption than before.
SymptomsFiles are encrypted with the previous extension of the ransomware – .r5a. There are new instructions, which include promotions to try to make users pay up.
Distribution MethodSpam Emails, Email Attachments, File Sharing Networks
Detection Tool See If Your System Has Been Affected by 7ev3n-HONE$T


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss 7ev3n-HONE$T.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

7ev3n-HONE$T Ransomware – Spread

The 7ev3n-HONE$T ransomware could spread via few ways. Probably the most effective of these ways is by using spam emails that have malicious attachments. Opening the attachment will infect your computer. Malware code may be inside the email’s body, and just opening the email might be enough to get infected.

The virus might spread through other ways, such as social media and file sharing networks. They might distribute 7ev3n-HONE$T with attachments and files. The files or attachments can hide the virus, but pretend to be useful. Do not click on anything, especially if you have landed on an untrusted website.

7ev3n-HONE$T Ransomware – More Information

7ev3n-HONE$T is the new name of the ransomware virus. You can read about its past variant – 7ev3n Ransomware. If your computer got infected with it, the virus will try to evade detection and hide as some other program. The initial variant of this ransomware used the following names:

  • UAC.exe
  • A13-1.exe
  • System.exe

The latest update might try to disguise itself as other processes. To boot everytime the Windows OS loads, the ransomware makes two registry values in the Windows Registry. As before they are both connected with the System.exe file, although other process names might be at play as well. The registry entries are the following:




7ev3n-HONE$T will create multiple copies of the text file with the ransom note, much like its predecessor.

This is a warning message that appears on your screen:

STF-7ev3n-hone$t-honest-ransomware-virus- ransom-note-screen-message

Here is what the newer ransom warning message states:

All your photos, media, documents, databases, MS Office and other important files were encrypted with strong algorithm.
References as an aid to take correct decision: (click on the link for opening)

Decryption price 1.0 bitcoin (400 USD)
Unique bitcoin address for payment was generated only for you:
File decryption process is completely automated! The process is “PAY – DECRYPT”.
1. The list of encrypted files are available by click on “VIEW”.
2. You are able to decrypt 3-5 files free of charge. The choice is random. Therefor click on “TEST DECRYPT”.
3. You are able to decrypt the half (50%) of the files, therefor pay 0.6 BTC (240 USD) to unique address specified above the program will randomly choose the half of the files and decrypt them. Since then you can pay additional 0.6 BTC (240 USD) and the program will decrypt the rest of the files. If you pay the total amount (1.0) at one you get 20% discount.
4. Confirmation of one transaction takes 30 minutes or less. The process of files decryption and self-deleting is automated. Decryption process takes 1-3 hours based on the amount of encrypted files, decryption speed is 7 Gb / hr.
5. To get keys and start decrypting process after payment, please ensure that your internet-connection is active!
6. If you don’t know that are bitcoins, how to purchase and use them click on “How to Pay”.

Don’t try to delete the program, any delete actions will be resulted in irrecoverable loss of your files. Don’t try to change file names and their extensions. Don’t enable Antivirus of Firewall software. The only way to recover access to your files is to pay for decryption process. Encryption algorithm is invincible. There are no third programs for this algorithm decryption and there would not be any.

Attention! you have to pay within 72 hours. If the payment is not performed, private key will be destroyed and files will be lost.

7ev3n-HONE$T ransomware will search for files to encrypt. Here are some of the file extensions it can encrypt:

→.jpg, .js, .mdb, .odt, .pdf, .doc, .txt, .xls, .xlsx, .xml, .docx, .html, .php, .png, .ppt, .pptx, .sql

Surely, there are more files the ransomware can encrypt. The file extension that is appended to all encrypted files is once more .r5a.

The 7ev3n-HONE$T ransomware creators try to be honest as the new sum for paying the ransom is just 1 BitCoin or 400 dollars. And that’s the preferable sum for most modern ransomware types. There are promotions for you to pay a bit more than half the money ($240) for half of your files unlocked, or paying the full sum within the first 72 hours and getting a 20% off ($300 total).

We advise NOT to pay the ransom as nothing can serve as a guarantee that you will get your files back or even if the virus makers will contact you back.

Shadow Volume Copies may also be erased from the Windows operating system. So, after removing this virus, you should see the 3rd section of the instructions guide provided below to see how you can try to restore your files.

Remove 7ev3n-HONE$T Ransomware and Restore .r5a Encrypted Files

If you got infected by the 7ev3n-HONE$T virus, you should have a little bit of experience in removing malware. The virus could keep spreading and continue to lock more files, so it is recommended for you to follow the step-by-step instructions below:


Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share