7ev3n ransomware-affected file
File type: Ransomware encrypted file
A file with the .r5a file extension is an original file encrypted and renamed by the 7ev3n ransomware.
The ransomware replaces the original filename with a number and appends the .r5a file extension.
File type category:
Ransomware encrypted file
Date updated: October 6, 2026
The .r5a file extension is associated with the 7ev3n ransomware. A later variant was identified as 7ev3n-HONE$T.
A .r5a file contains an encrypted version of an original file. The ransomware renames the files sequentially, so a folder that originally contained 10 files may contain files named 1.r5a, 2.r5a and so on up to 10.r5a.
Known targeted file types include dbf, arw, txt, doc, docm, docx, zip, rar, xlsx, xlsb, xlsm, pdf, jpg, jpe, jpeg, sql, mdf, accdb, mdb, odb, odm, odp and ods. 7ev3n also installs several .bat files in critical locations, can damage the computer, changes the registry and may prevent the use of certain key combinations.
A .r5a file cannot be opened as a normal document because its contents are encrypted. On Microsoft Windows, use a decoder for 7ev3n ransomware if one is available for the affected variant.
Decrypting the file is required before the original data can be used. Do not expect a standard archive or document application to open it.
There is no normal conversion from the .r5a format to another file format. The file must first be decrypted or recovered from an unaffected backup.
A decoder for 7ev3n ransomware may recover the original data when it supports the variant involved, but recovery is not guaranteed.
Software apps that recover r5a files:
Microsoft Windows
Language
