Elex

Overview

Adware:Win32/Elex is a highly pervasive and aggressive family of adware and browser hijackers. It is typically distributed through software bundling, where it is silently installed alongside free software downloaded from third-party sites. Once active, Elex modifies browser shortcuts, alters default search engine settings, and hijacks the homepage to forcefully redirect web traffic through advertiser networks. It often injects intrusive advertisements, pop-ups, and sponsored links into legitimate web pages. To prevent easy removal, Elex frequently employs defense evasion techniques, such as deploying scheduled tasks, creating hidden services, or utilizing rootkit-like behaviors to constantly restore its components if a user attempts to delete them.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ELEX {
    meta:
        description = "Detects Elex (adware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "elex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Elex Activity
id: 93725b9fc52918f65c42dd16492d7d98
status: experimental
description: Detects generic indicators of the elex malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*elex*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use specialized anti-adware and anti-malware utilities (e.g., Malwarebytes, AdwCleaner) to root out persistent registry keys and hidden files.
2. Manually inspect and repair modified web browser shortcuts (checking the 'Target' field for appended malicious URLs).
3. Reset affected web browsers to their default settings to clear malicious extensions and hijacked search engine configurations.
4. Audit Windows Scheduled Tasks for suspicious entries designed to reinstall Elex.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not download software from untrusted third-party aggregators, and always opt for 'Custom' or 'Advanced' installation to decline bundled offers.

References & External Analysis

• Search "elex" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: adware)

Explore other malware families in the same category:

• Dealply
• Spigot
• Kuaizip
• Ulise
• Shipup

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/elex.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.