{
  "family": "malex",
  "sample_count": 30,
  "category": "trojan",
  "description": "Malex (tracked across endpoint security engines and antimalware research telemetry under signatures including Trojan:Win32/Malex, Trojan:Win32/Malex.gen!A, and Trojan.Malex) is a heuristic and generic detection signature applied to obfuscated Windows trojan binaries, modular loaders, and stagers active since 2013. Designed to bypass traditional signature scanning through dynamic packing, custom crypters, and polymorphic code transformations, Malex variants execute unauthorized system modifications upon compromise. The malware typically establishes persistence by creating entries in the Windows Run keys, disables host security tools and event logging, and injects malicious threads into legitimate processes such as svchost.exe or explorer.exe. Malex binaries communicate with remote threat actor infrastructure over encrypted HTTP/HTTPS protocols, staging secondary payloads ranging from infostealers and credential dumpers to ransomware and remote access implants.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Malex",
    "Trojan:Win32/Malex.gen!A",
    "Trojan.Malex",
    "Win32/Malex",
    "Trojan:Win32/Malex.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Malex?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malex is an antivirus heuristic classification detecting evasive, obfuscated Windows trojans, droppers, and initial access loaders."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Malex classified as a generic heuristic detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security engines use Malex to flag novel or packed binaries that exhibit malicious behavioral indicators like unauthorized code injection and registry autorun modification."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are typically dropped by Malex?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malex droppers are frequently observed delivering info-stealers, keyloggers, banking trojans, cryptocurrency miners, and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Malex evade static antivirus scanning?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses custom runtime packing, API dynamic resolution through PEB hash lookups, and anti-emulation execution delays."
      }
    },
    {
      "@type": "Question",
      "name": "How should enterprise security teams respond to a Malex alert?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, review process lineage logs in EDR for spawned children or process hollowing into svchost.exe, and submit the binary for sandbox detonation."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1562.001",
    "T1055",
    "T1204.002",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Phishing Attachments",
    "Trojanized Software Keygens & Cracks",
    "Exploit Kit Drive-by Compromise"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Dynamic Runtime Obfuscation & Packing",
    "Process Injection into svchost.exe & explorer.exe",
    "Security Control & Antivirus Tampering",
    "Secondary Payload Downloading & Staging",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Obfuscated Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP/HTTPS beacons communicating host operating system details and hardware identifiers to remote C2 servers",
      "Direct IP connections downloading secondary encrypted binary payloads"
    ],
    "evasion_techniques": [
      "Dynamic API resolution via PEB hashing to conceal critical system calls from static file inspection",
      "Terminating security logging and antivirus hooks via user-mode API unhooking"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "d1e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7",
      "e2f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MalexLoader",
      "HKCU\\Software\\Malex"
    ],
    "file_paths": [
      "%Temp%\\malex_stager.exe",
      "%AppData%\\Malex\\cache.dat",
      "%LocalAppdata%\\Temp\\stub.bin"
    ]
  },
  "defensive_measures": [
    "Deploy behavior-based endpoint detection to identify anomalous code injection and memory modification in svchost.exe",
    "Restrict executable launches from user writable locations including %Temp% and %AppData%",
    "Implement perimeter inspection to block outbound traffic to unclassified IP addresses and high-risk domains"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Malex",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Malex"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Malex",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Malex.gen!A",
      "Trojan:Win32/Malex.A"
    ]
  },
  "motivation": "Initial Access Facilitation, Crimeware Distribution & Defense Evasion",
  "sample_hashes": []
}