e_win.exe
Classification: Malicious
e_win.exe is a ransomware (Windows executable). Detected by 57 antivirus engines. Linked to Babuk malware. 46 sightings, last seen 2026-04-28.
Detection summary
- 57 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: BABUK (S0638)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Babuk | Triage | 2026-04-28 18:40:24 | 2026-04-28 18:40:24 | malicious-activity | S0638 Babuk |
| Generic Malware | Hybrid-Analysis | 2026-01-24 00:39:44 | 2026-01-24 01:30:11 |
Tags
babuk defense_evasion discovery execution impact ransomwareSample information
- Filenames
- e_win.exe, da048f23182f24d9fbfb64d0ca28faa4a82f48897de2fb234670ba3817966e43.bin
- File type
- PE32 executable for MS Windows 6.00 (GUI), Intel i ...
- MD5
06f3b3966046b6f90922f7d2f7a22367- SHA-1
23c360d9e31d125fa0443405d18fda17d8f8e48a- SHA-256
da048f23182f24d9fbfb64d0ca28faa4a82f48897de2fb234670ba3817966e43- First indexed
- 2026-01-24 00:33:06
- Last updated
- 2026-08-12 22:52:05
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.Ransom.Babuk.A |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Ransom] |
| AhnLab-V3 | Ransomware/Win.Babuk.R428564 |
| Antiy-AVL | Trojan/Win32.Babuk |
| Arcabit | Trojan.Ransom.Babuk.A |
| Avast | Win32:MalwareX-gen [Ransom] |
| Avira | TR/Crypt.EPACK.Gen2 |
| BitDefender | Trojan.Ransom.Babuk.A |
| CAT-QuickHeal | Ransom.Babuk.S22456537 |
| CTX | exe.ransomware.babuk |
| ClamAV | Win.Ransomware.Packer-7473772-1 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Encoder.41942 |
| ESET-NOD32 | Win32/Filecoder.Babyk.A trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.FileCoder (A) |
| F-Secure | Trojan.TR/Crypt.EPACK.Gen2 |
| Fortinet | W32/FilecoderProt.F183!tr.ransom |
| GData | Trojan.Ransom.Babuk.A |
| Detected | |
| Gridinsoft | Ransom.Win32.Babyk.bot!se39903 |
| Ikarus | Trojan-Ransom.Babyk |
| K7AntiVirus | Trojan ( 005cbaa21 ) |
| K7GW | Trojan ( 005a72cf1 ) |
| Kaspersky | Trojan-Ransom.Win32.Babuk.a |
| Kingsoft | malware.kb.a.999 |
| Malwarebytes | Generic.Malware.Gen.DDS |
| MaxSecure | Trojan.Malware.325363237.susgen |
| McAfeeD | ti!DA048F23182F |
| MicroWorld-eScan | Trojan.Ransom.Babuk.A |
| Microsoft | Trojan:Win32/Babuk!ic |
| Panda | Trj/Genetic.gen |
| Rising | Ransom.Babuk!1.DFFF (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Crypt |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Ransomware.lm |
| Sophos | Troj/Ransom-GGD |
| Symantec | Ransom.Gen.HC |
| TACHYON | Ransom/W32.BabukLocker.80896.B |
| Tencent | Trojan-Ransom.Win32.Filecoder.16000569 |
| TrellixENS | GenericRXNS-AS!06F3B3966046 |
| TrendMicro | Ransom.Win32.BABUK.SMFRA |
| TrendMicro-HouseCall | Ransom.Win32.BABUK.SMFRA |
| VBA32 | BScope.TrojanRansom.Babyk |
| VIPRE | Trojan.Ransom.Babuk.A |
| Varist | W32/Ransom.PS.gen!Eldorado |
| ViRobot | Trojan.Win32.Ransom.80896.E |
| VirIT | Ransom.Win32.Babuk.DAX |
| Webroot | W32.Malware.gen |
| Zillya | Trojan.Babuk.Win32.2 |
| ZoneAlarm | Troj/Ransom-GGD |
| alibabacloud | RansomWare:Win/Babyk.fe8b6eb7 |
| huorong | Ransom/BTCware.h |