e_win.exe
Classification: Malicious
e_win.exe is a ransomware (application/x-dosexec). Detected by 52 antivirus engines. Linked to Babuk malware. 2 sightings from Abuse.ch, last seen 2021-03-01.
Detection summary
- 52 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: BABUK (S0638)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic.Malware | Abuse.ch | 2021-03-01 10:16:14 | 2021-03-01 10:16:14 | malicious-activity | |
| Babuk | Abuse.ch | 2021-03-01 10:16:14 | 2021-03-01 10:16:14 | malicious-activity | S0638 Babuk |
Sample information
- Filenames
- e_win.exe
- File type
- application/x-dosexec
- MD5
03f524377f461bfa70859fb5805b5a03- SHA-1
e8ead4332cded71755e478922d09d01975f9119f- SHA-256
ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847- First indexed
- 2021-03-01 11:15:06
- Last updated
- 2026-07-29 19:19:05
Antivirus detections
| Engine | Detection |
|---|---|
| Bkav | W32.AIDetect.malware2 |
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Gen:Heur.Ransom.REntS.Gen.1 |
| FireEye | Generic.mg.03f524377f461bfa |
| CAT-QuickHeal | Trojanransom.Generic |
| Qihoo-360 | Win32/Ransom.Generic.HxQBl38A |
| McAfee | GenericRXNS-AS!03F524377F46 |
| Cylance | Unsafe |
| Sangfor | Ransom.Win32.BabukLocker.MK!MTB |
| K7AntiVirus | Trojan ( 005786171 ) |
| Alibaba | Ransom:Win32/generic.ali2000010 |
| K7GW | Trojan ( 005786171 ) |
| CrowdStrike | win/malicious_confidence_90% (W) |
| BitDefenderTheta | Gen:NN.ZexaF.34590.euW@aqQHyvg |
| Cyren | W32/Ransom.PKXV-6653 |
| Symantec | Ransom.Babuk |
| APEX | Malicious |
| Paloalto | generic.ml |
| ClamAV | Win.Ransomware.Maze-7473772-0 |
| Kaspersky | HEUR:Trojan-Ransom.Win32.Generic |
| BitDefender | Gen:Heur.Ransom.REntS.Gen.1 |
| Ad-Aware | Gen:Heur.Ransom.REntS.Gen.1 |
| Sophos | Mal/Generic-S |
| F-Secure | Trojan.TR/Ransom.zbxjk |
| DrWeb | Trojan.Siggen12.17088 |
| TrendMicro | Ransom.Win32.BABUKLOCKER.SM |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.lm |
| Emsisoft | Trojan.FileCoder (A) |
| SentinelOne | Static AI - Malicious PE |
| GData | Win32.Trojan-Ransom.Babuk.A |
| Webroot | W32.Trojan.Gen |
| Avira | TR/Ransom.zbxjk |
| MAX | malware (ai score=82) |
| Gridinsoft | Ransom.Win32.AI.sa |
| Arcabit | Trojan.Ransom.REntS.Gen.1 |
| AegisLab | Trojan.Win32.Generic.j!c |
| ZoneAlarm | HEUR:Trojan-Ransom.Win32.Generic |
| Microsoft | Ransom:Win32/BabukLocker.MK!MTB |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Trojan/Win32.BabukRansom.C4337300 |
| Acronis | suspicious |
| ALYac | Gen:Heur.Ransom.REntS.Gen.1 |
| VBA32 | BScope.TrojanRansom.Gen |
| Malwarebytes | Malware.AI.1000942615 |
| Panda | Trj/GdSda.A |
| ESET-NOD32 | a variant of Win32/Filecoder.Babyk.A |
| TrendMicro-HouseCall | Ransom.Win32.BABUKLOCKER.SM |
| Rising | Ransom.Generic!8.E315 (CLOUD) |
| Ikarus | Trojan-Ransom.Babyk |
| Fortinet | W32/FilecoderProt.F183!tr.ransom |
| AVG | Win32:Malware-gen |
| Avast | Win32:Malware-gen |