Revenge Of Heisenberg Ransomware

Overview of Revenge Of Heisenberg Ransomware

Revenge Of Heisenberg is a ransomware strain based on the Chaos ransomware family. This malicious software encrypts a victim’s files and demands a ransom in Bitcoin for their decryption. Discovered during a routine inspection of new file submissions to VirusTotal, it has two known variants that append encrypted files with a four-character random extension.

Upon successful encryption, the ransomware modifies the victim’s desktop wallpaper and generates a ransom note in a text file named read_it.txt. The ransom amount demanded varies between $500 and $1,500, with payment required in Bitcoin. Additionally, this ransomware possesses a dangerous clipboard hijacking capability that alters copied cryptocurrency wallet addresses, a tactic typically seen in clippers.

Threat Summary

Attribute	Details
Name	Revenge Of Heisenberg Ransomware
Threat Type	Ransomware, Crypto Virus, File Locker
Encrypted Files Extension	Appends a four-character random extension (e.g., .nw2n)
Ransom Note File	read_it.txt
Ransom Amount	0.1473766 BTC (~$15,000 at current exchange rates), $500, or $1,500
Bitcoin Addresses Used	bc1qw0ll8p9m8uezhqhyd7z459ajrk722yn8c5j4fg, 17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV, bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vptabc123, bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9aa
Detection Names	Avast (Win32:RansomX-gen [Ransom]), ESET-NOD32 (A Variant Of MSIL/Filecoder.Chaos.A), Kaspersky (HEUR:Trojan-Ransom.MSIL.Agent.gen), Microsoft (Ransom:MSIL/FileCoder.AD!MTB)
Symptoms of Infection	Files are encrypted with a new extension, ransom note appears, changed desktop wallpaper, inability to access files, ransom demand in Bitcoin
Damage	Encrypts all files, prevents access to data, may install additional trojans
Distribution Methods	Infected email attachments, torrent websites, malicious ads, phishing emails, drive-by downloads, cracked software
Danger Level	High

Ransom Note Text

HA HA HA, Revenge of Heisenberg!!!
All of your files have been encrypted
Your computer was infected with a ransomware virus. Your files have been encrypted and you won't
be able to decrypt them without our help.
What can I do to get my files back?
You can buy our special decryption software, this software will allow you to recover all of your data and remove the
ransomware from your computer.
The price for the software is $500. Payment can be made in Bitcoin only.
How do I pay, where do I get Bitcoin?
Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search
yourself to find out how to buy Bitcoin.
Many of our customers have reported these sites to be fast and reliable:
Coinmama - hxxps://www.coinmama.com
Bitpanda - hxxps://www.bitpanda.com

Payment information:
Amount: 0.1473766 BTC
Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9aa

How to Remove Revenge Of Heisenberg Ransomware

Step 1: Use SpyHunter to Detect and Remove the Malware

1. Download and Install SpyHunter.
2. Run a Full System Scan: Launch SpyHunter and initiate a complete system scan to detect any ransomware traces.
3. Remove Detected Threats: Once the scan is complete, remove all identified threats.
4. Restart Your PC: Reboot your computer to complete the removal process.

Step 2: Restore Your Files

Since there is no free decryptor available, the best way to recover files is through backups.

• Use an External Backup: If you have a backup stored on an external device or cloud storage, restore your files.
• Shadow Volume Copies (If Available): Try using Windows built-in shadow volume copies via System Restore.
• Data Recovery Software: Tools like Recuva or EaseUS Data Recovery may help recover lost files.

How to Prevent Ransomware Attacks

1. Keep Regular Backups
   • Store backups on multiple devices and in the cloud.
   • Disconnect backup devices after use to prevent ransomware encryption.
2. Avoid Suspicious Links and Attachments
   • Do not open email attachments from unknown sources.
   • Avoid clicking on pop-ups and ads from untrusted websites.
3. Use Strong Security Software
   • Install SpyHunter for real-time protection against malware.
   • Keep your antivirus updated.
4. Enable Controlled Folder Access in Windows
   • Go to Windows Defender Security Center > Virus & Threat Protection > Ransomware Protection.
   • Enable Controlled Folder Access to protect important directories.
5. Use a Firewall and Keep Software Updated
   • Ensure your firewall is turned on.
   • Regularly update Windows and installed programs to patch vulnerabilities.
6. Beware of Cracked Software and Torrents
   • Many ransomware infections originate from illegal downloads.
   • Stick to official sources for software downloads.
7. Employ Multi-Factor Authentication (MFA): Protect online accounts and cryptocurrency wallets with MFA.

Conclusion

Revenge Of Heisenberg ransomware is a highly dangerous threat that encrypts files and demands a ransom for their decryption. With no free decryptor available, the best course of action is to remove the ransomware using SpyHunter and restore files from backups. Preventive measures, such as keeping regular backups, avoiding suspicious downloads, and using strong security software, are essential in safeguarding against future ransomware infections.