Havoc Ransomware

Our research team has recently discovered Havoc Ransomware. This infection is extremely suspicious, but it is not yet known whether or not it will attack regular computer users. In a video that was made public via youtube.com, it is stated that this infection was created just to see if it is hard to created ransomware, as well as to test its potential. Although it is stated that this infection would not be released as a real infection, who’s to say that malware creators can be trusted? Whether or not this threat is unleashed, we have to discuss it because it is malicious, and it has the potential to be just as dangerous as Erebus Ransomware, CryptoSweetTooth Ransomware, and all other ransomware infections whose removal we have discussed in separate reports. If you want to learn more about the infection, you should continue reading this report. We even discuss how to remove Havoc Ransomware.

According to the malware researchers working in our internal lab, Havoc Ransomware can use AES (Advanced Encryption Standard) to encrypt files. It appears that the current version of this threat is capable of encrypting files found on the Desktop and all subfolders. When the file is encrypted, it gains the “.HavocCrypt” extension, and that can help you both recognize the culprit and find the corrupted files. One more thing to note is that when Havoc Ransomware attaches its unique extension, it also replaces the dots in the file name with underscores. For example, if the infection encrypts a file called “test.doc”, it will appear to you as “test_doc.HavocCrypt”. Do you know what initiates the encryption of files? A malicious .exe file is responsible for that, and it is unclear how the creator of the ransomware could spread it because it is not being spread at the moment. Of course, considering that most threats like this one are either spread via spam emails, installed by Trojans, or infiltrated using RDP vulnerabilities, it is most likely that it would be distributed using one of these methods.

As soon as the encryption of files is completed, Havoc Ransomware should showcase a ransom note. This note should be launched from the main .exe file because the ransomware does not create new files. The information provided via the ransom note is not surprising. Just like most other ransomware infections, this one demands a ransom of $150 to be paid in Bitcoins (~0.17 BTC). Also, there is a request to confirm the payment by emailing HavocPayday@Signant.Org. The ransom note also informs that if you close this application or shut down the PC, the decryption key will be lost. Unfortunately, that is not a trick used for intimidation. If you restart your computer, the ransomware will not start again because there is no point of execution, and the decryption option provided to you will not work.

At this time, the victim of Havoc Ransomware could easily decrypt the files by clicking the “Decrypt My Files” button five times. After this, all files are decrypted. Obviously, if this infection was released as a real infection, it is unlikely that this trick would work. On the contrary, it is most likely that you would have no other option but to pay the ransom requested. Hopefully, the creator of this infection does not release it as promised, but no one can guarantee that. On top of that, there are already plenty of ransomware threats that can do much more damage and that can coerce you into paying much bigger ransoms. Even if you do not need to worry about this particular infection, you have to make sure you take measures to protect your operating system and personal files. For example, if you have not set up a file backup, you need to do that right away. Even if files get encrypted, you could recover them from backup.

If the computer is not restarted when the ransom note of Havoc Ransomware appears, all one has to do is click “Decrypt My Files” five times to decrypt files and then delete the malicious .exe launcher. After this, even the Task Manager will be unblocked, which is what the ransomware does. All in all, this is all hypothetical because this infection is unlikely to strike. Unfortunately, other threats similar to this one exist, and it is crucial to employ security software to avoid the infiltration of malware, as well as to back up personal files to prevent their loss.

Havoc Ransomware Removal

1. Click Decrypt My Files 5 times until the files are decrypted.
2. Right-click and Delete the malicious .exe file.
3. Empty Recycle Bin.
4. Install a malware scanner to examine your PC for leftovers.