e_win.exe
Classification: Malicious
e_win.exe is a malicious file sample. Linked to Babuk malware. Reported by 2 threat sources, last seen 2026-03-31. Detected by 60 antivirus engines.
Detection summary
- 60 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: BABUK (S0638)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Hybrid-Analysis | 2026-03-31 15:45:04 | 2026-03-31 15:45:04 | ||
| Babuk | Triage | 2026-03-31 15:11:52 | 2026-03-31 15:11:52 | malicious-activity | S0638 Babuk |
Tags
ransomware babuk defense_evasion discovery execution impactSample information
- Filenames
- e_win.exe, 77255c1eef5e764363302a2505bcda6e9ac8d30ac7a0e7e0c62499359b0df2b8.bin
- File type
- PE32 executable for MS Windows 6.00 (GUI), Intel i ...
- MD5
9ed28b4aa6c20eddb1e4dffd77e17418- SHA-1
b8b8e8cc5916cf759d412d29fcf99b6da594206d- SHA-256
77255c1eef5e764363302a2505bcda6e9ac8d30ac7a0e7e0c62499359b0df2b8- First indexed
- 2026-03-31 15:11:52
- Last updated
- 2026-07-19 00:33:08
Antivirus detections
| Engine | Detection |
|---|---|
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Ransom] |
| AhnLab-V3 | Ransomware/Win.Babuk.R428564 |
| Alibaba | Ransom:Win32/Babuk.af7 |
| Antiy-AVL | Trojan/Win32.Babuk |
| Arcabit | Trojan.Ransom.Babuk.A |
| Avast | Win32:MalwareX-gen [Ransom] |
| Avira | HEUR/AGEN.1316053 |
| BitDefender | Trojan.Ransom.Babuk.A |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Ransom.Babuk.S22456537 |
| CTX | exe.ransomware.babuk |
| ClamAV | Win.Ransomware.Packer-7473772-1 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DrWeb | Trojan.Encoder.41942 |
| ESET-NOD32 | Win32/Filecoder.Babyk.A trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.FileCoder (A) |
| F-Secure | Heuristic.HEUR/AGEN.1316053 |
| Fortinet | W32/FilecoderProt.F183!tr.ransom |
| GData | Trojan.Ransom.Babuk.A |
| Detected | |
| Gridinsoft | Ransom.Win32.Babyk.bot!se39903 |
| Ikarus | Trojan-Ransom.Babyk |
| K7AntiVirus | Trojan ( 005cbaa21 ) |
| K7GW | Trojan ( 005a72cf1 ) |
| Kaspersky | Trojan-Ransom.Win32.Babuk.a |
| Kingsoft | Win32.Trojan-Ransom.Babuk.a |
| Lionic | Trojan.Win32.Babuk.trPT |
| Malwarebytes | Ransom.Babuk |
| MaxSecure | Trojan.Malware.644502601.susgen |
| McAfeeD | Trojan:Win/Babuk.EAA |
| MicroWorld-eScan | Trojan.Ransom.Babuk.A |
| Microsoft | Trojan:Win32/Babuk!ic |
| NANO-Antivirus | Trojan.Win32.Ransom.iuaipi |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Rising | Ransom.Babuk!1.D7A0 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Crypt |
| Sangfor | Ransom.Win32.Babuk.Vai6 |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Ransomware.lm |
| Sophos | Troj/Ransom-GGD |
| Symantec | Ransom.Gen.HC |
| TACHYON | Ransom/W32.BabukLocker.80896.B |
| Tencent | Trojan-Ransom.Win32.Filecoder.16000569 |
| TrellixENS | GenericRXNS-AS!9ED28B4AA6C2 |
| TrendMicro | Ransom.Win32.BABUK.SMFRA |
| TrendMicro-HouseCall | Ransom.Win32.BABUK.SMFRA |
| VBA32 | BScope.TrojanRansom.Babyk |
| VIPRE | Trojan.Ransom.Babuk.A |
| Varist | W32/Ransom.PS.gen!Eldorado |
| ViRobot | Trojan.Win32.Ransom.80896.E |
| VirIT | Ransom.Win32.Babuk.DAX |
| Webroot | W32.Malware.gen |
| ZoneAlarm | Troj/Ransom-GGD |
| alibabacloud | RansomWare:Win/Babyk |
| huorong | Ransom/LockFile.kg |