Ransomware Research
OXAR Ransomware
OXAR is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on July 1, 2017, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: Kappa.
Quick Facts
- Ransomware Family
- OXAR
- First Seen
- July 1, 2017
- Known Aliases
- Kappa
How OXAR Ransomware Works
Targeted Files
https://app.any.run/tasks/f33e157d-447a-4b5b-a61d-70b9c9085601
File Encryption Patterns
OXAR modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..OXR..PEDO..ULOZ..FUCK..FDPRansom Note and Payment Demands
After encrypting files, OXAR displays ransom notes demanding payment for file recovery:
instructions.txtRansom message:
notes/instructions.txt
Note locations:
Desktop1 What happens with my files.txtRansom message:
notes/1 What happens with my files.txt
Note locations:
EveryFolderRansom message:
notes/note.txt
Note locations:
OnceOnCompletionRansom message:
notes/note1.txt
Note locations:
LoginRansom message:
notes/wallpaper.bmp
Note locations:
DesktopTechnical Indicators
Associated Executable Files
The following executable files are associated with OXAR ransomware:
Data Locker.exeLockedIn.binLockedIn.exerbgfdvcx.exePEDO.exeCryptear.exeras.exeAbleton-live-Suite-v95-WiN-x86-x64.exeransomware.exeKappa Ransomware.exeAbleton-live-Suite-v95-WiN-x86-x64.exe (ras.exe)
Elastio Can Help You
Don't let OXAR ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This OXAR ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like OXAR.
Last updated: July 30, 2025