Locky ransomware-affected file
File type: Ransomware encrypted file
An aesir file is a file renamed and encrypted by the Locky ransomware. Files with this suffix were observed from November 2016.
The encryption prevents the original data from being opened normally. The suffix is not a standalone document format.
File type category:
Ransomware encrypted file
Date updated: October 12, 2026
The aesir file extension was used as a filename suffix by a Locky ransomware variant from November 2016. Earlier Locky campaigns used the zepto, locky and odin extensions.
Locky targeted Windows computers and encrypted users' files, changing their names to use the .aesir suffix. An aesir file contains encrypted data from the affected user's original file, rather than data created in a format supported by a normal application.
An infection may also leave ransom notes containing payment instructions and display the characteristic grey or pink Locky wallpaper. The suffix belongs to the ransomware activity and is not normally used by legitimate software.
No ordinary application can open an aesir file as the original document, image or other data. Renaming the file or changing its extension does not decrypt it.
Unfortunately, there is no decryptor for .aesir files available. The original data may only be recoverable from an unaffected backup.
An aesir file cannot be meaningfully converted while it remains encrypted. Decryption or recovery must take place before the original data can be opened or exported to another format.
Language