sub_8203c2f00ecd.bin

Classification: Malicious

sub_8203c2f00ecd.bin is a ransomware (application/x-dosexec, 30.5 KB). Flagged by 22% of antivirus engines (96 detections). Linked to Babuk malware.

Detection summary

  • 96 antivirus detections (22% detection ratio)
  • 0 IDS alerts
  • 4 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: BABUK (S0638)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Cyber Threat Alliance 2026-09-30 22:00:32 2026-10-14 23:00:28 malicious-activity
Babuk Triage 2026-05-24 01:39:58 2026-05-24 01:39:58 malicious-activity S0638 Babuk
Generic.Malware Abuse.ch 2021-01-03 01:12:40 2021-01-03 01:12:40 malicious-activity
Babuk Abuse.ch 2021-01-03 01:12:40 2021-01-03 01:12:40 malicious-activity S0638 Babuk
DangerousObject.Multi Hybrid-Analysis 2021-01-01 16:30:27 2021-01-01 16:30:27

Tags

ransomware babuk credential_access defense_evasion discovery execution impact spyware stealer

Sample information

Filenames
sub_8203c2f00ecd.bin, 8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9.bin, BABUK.exe
File type
application/x-dosexec
Size
31232 bytes
MD5
e10713a4a5f635767dcd54d609bed977
SHA-1
320d799beef673a98481757b2ff7e3463ce67916
SHA-256
8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9
First indexed
2021-01-01 16:30:27
Last updated
2026-07-29 19:19:05

Antivirus detections

EngineDetection
BkavW32.AIDetectVM.malware1
MicroWorld-eScanTrojan.GenericKD.35955416
ALYacTrojan.GenericKD.35955416
CylanceUnsafe
CrowdStrikewin/malicious_confidence_70% (D)
AlibabaRansom:Win32/generic.ali2000010
K7GWTrojan ( 004f78ba1 )
K7AntiVirusTrojan ( 004f78ba1 )
BitDefenderThetaGen:NN.ZexaF.34700.bqW@a8Wblgo
CyrenW32/Trojan.DBDH-6752
SymantecML.Attribute.HighConfidence
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan.Win32.DelShad.frh
BitDefenderTrojan.GenericKD.35955416
AvastWin32:Trojan-gen
TencentWin32.Trojan.Raas.Auto
Ad-AwareTrojan.GenericKD.35955416
EmsisoftTrojan.GenericKD.35955416 (B)
McAfee-GW-EditionBehavesLike.Win32.Dropper.nh
FireEyeGeneric.mg.e10713a4a5f63576
SophosMal/Generic-S
IkarusTrojan-Ransom.FileCrypter
MicrosoftRansom:Win32/BabukLocker.MK!MTB
GridinsoftRansom.Win32.DelShad.oa
ArcabitTrojan.Generic.D224A2D8
AegisLabTrojan.Multi.Generic.4!c
ZoneAlarmTrojan.Win32.DelShad.frh
GDataTrojan.GenericKD.35955416
CynetMalicious (score: 100)
McAfeeArtemis!E10713A4A5F6
MAXmalware (ai score=84)
ESET-NOD32a variant of Win32/Filecoder.NHQ
Rising[email protected] (RDMK:Ec91h0fZKAUNkJcmfZBzUw)
SentinelOneStatic AI - Malicious PE
FortinetW32/FilecoderProt.F183!tr.ransom
MaxSecureTrojan.Malware.121218.susgen
AVGWin32:Trojan-gen
PandaAdware/SecurityProtection
Qihoo-360Win32/Trojan.368
ALYacTrojan.Ransom.Filecoder
AVGWin32:MalwareX-gen [Ransom]
AhnLab-V3Ransomware/Win.Babuk.R428564
AlibabaRansom:Win32/Babuk.4a4
Antiy-AVLTrojan[Ransom]/Win32.Babyk
ArcabitTrojan.Ransom.Babuk.B
AvastWin32:MalwareX-gen [Ransom]
AviraTR/Redcap.iocwq
BitDefenderTrojan.Ransom.Babuk.B
BkavW32.AIDetectMalware
CAT-QuickHealRansom.BabukLockr.S18135446
CTXexe.ransomware.babuk
ClamAVWin.Ransomware.Babuk-9819006-0
CrowdStrikewin/malicious_confidence_100% (W)
DeepInstinctMALICIOUS
DrWebTrojan.Encoder.41942
ESET-NOD32a variant of Win32/Filecoder.Babyk.A
Elasticmalicious (high confidence)
EmsisoftTrojan.FileCoder (A)
F-SecureTrojan.TR/Redcap.iocwq
GDataWin32.Trojan-Ransom.Babuk.A
GoogleDetected
GridinsoftRansom.Win32.Filecoder.sd!s1
IkarusTrojan-Ransom.Babyk
JiangminTrojan.DelShad.ayo
KasperskyTrojan-Ransom.Win32.Babuk.b
Kingsoftmalware.kb.a.910
LionicTrojan.Win32.Babuk.j!c
MalwarebytesGeneric.Ransom.FileCryptor.DDS
MaxSecureTrojan.Malware.300983.susgen
McAfeeDti!8203C2F00ECD
MicroWorld-eScanTrojan.Ransom.Babuk.B
MicrosoftRansom:Win32/Babuk.MAK!MTB
NANO-AntivirusTrojan.Win32.DelShad.ihixyr
RisingRansom.Babuk!1.D100 (CLASSIC)
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Suspicious PE
SkyhighBehavesLike.Win32.Ransomware.nh
SophosTroj/Ransom-GEI
SymantecRansom.Babuk
TACHYONRansom/W32.BabukLocker.31232
TencentTrojan-Ransom.Win32.Babyk.16000578
Trapminesuspicious.low.ml.score
TrellixENSRansom-Babuk!E10713A4A5F6
TrendMicroRansom.Win32.BABUK.THAODBB
TrendMicro-HouseCallRansom.Win32.BABUK.THAODBB
VBA32Trojan.DelShad
VIPRETrojan.Ransom.Babuk.B
VaristW32/Babyk.A.gen!Eldorado
ViRobotTrojan.Win32.Z.Agent.31232.BPU
XcitiumMalware@#1acf214xngmwj
YandexTrojan.DelShad!Tr/TntHTClE
ZillyaTrojan.Filecoder.Win32.17405
ZoneAlarmTroj/Ransom-GEC
alibabacloudRansomWare
huorongRansom/LockFile.kg

Process list

NameCommand line
BABUK.exe
cmd.exe/c vssadmin.exe delete shadows /all /quiet
vssadmin.exedelete shadows /all /quiet
DismHost.exe{82047E61-86A0-4474-A471-B6112DA7E946}