Overview

Adware:Win32/Elex is a highly pervasive and aggressive family of adware and browser hijackers. It is typically distributed through software bundling, where it is silently installed alongside free software downloaded from third-party sites. Once active, Elex modifies browser shortcuts, alters default search engine settings, and hijacks the homepage to forcefully redirect web traffic through advertiser networks. It often injects intrusive advertisements, pop-ups, and sponsored links into legitimate web pages. To prevent easy removal, Elex frequently employs defense evasion techniques, such as deploying scheduled tasks, creating hidden services, or utilizing rootkit-like behaviors to constantly restore its components if a user attempts to delete them.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Technique	Name	Tactic
`T1189`	Drive-by Compromise	Initial Access
`T1546`	Event Triggered Execution	Privilege Escalation
`T1562.001`	Impair Defenses: Disable or Modify Tools	Defense Evasion
`T1053.005`	Scheduled Task/Job: Scheduled Task	Persistence
`T1112`	Modify Registry	Defense Evasion

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ELEX {
    meta:
        description = "Detects Elex (adware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "elex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Elex Activity
id: 93725b9fc52918f65c42dd16492d7d98
status: experimental
description: Detects generic indicators of the elex malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*elex*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

Use specialized anti-adware and anti-malware utilities (e.g., Malwarebytes, AdwCleaner) to root out persistent registry keys and hidden files.
Manually inspect and repair modified web browser shortcuts (checking the 'Target' field for appended malicious URLs).
Reset affected web browsers to their default settings to clear malicious extensions and hijacked search engine configurations.
Audit Windows Scheduled Tasks for suspicious entries designed to reinstall Elex.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

Do not download software from untrusted third-party aggregators, and always opt for 'Custom' or 'Advanced' installation to decline bundled offers.

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Replit, StackBlitz, CodeSandbox, and CodePen.

Elex