TF-MAL-elf.sexi
📛 Threat Title
Malware family: SEXi
Description
ThreatFox malware family `elf.sexi`. Printable name: SEXi. Aliases: Limpopo,Formosa,Socotra.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.sexi
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.sexi
IOC database
- Type
- domain
- Value
elf.sexi- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.sexi
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.sexi
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:hodeitek.com
Benefits include: Real-time threat mitigation for web applications. Customizable security policies. Enhanced protection for business-critical web services. Conclusion Mallox ransomware by the SEXI -KEY group represents a significant and ongoing threat to businesses worldwide.
-
web:scanner.pcrisk.com
Is en.readbeast.blog safe to visit? Check our automated security scan: trust score 93/100, 0/91 engines flagged, SSL status, blacklist check. Report generated May 21, 2026. Results are for informational purposes only.
-
web:securelist.com
Key Group While the SEXi group has employed leaked ransomware variants from two malware families, other groups have taken this approach to a whole different level. For example, Key Group, aka keygroup777, has used no fewer than eight different ransomware families throughout their relatively short history (since April 2022) - see the image below.
-
web:windowsforum.com
The emergence of RESURGE signals more than just another entry in a long line of malware threats. According to CISA, RESURGE contains advanced persistence features inherited from the SPAWNCHIMERA malware family—a group notorious for its ability to survive system reboots and avoid simplistic remediation .
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.darkreading.com
SEXi's emergence stands at the crossroads of two major ransomware trends: the rash of threat actors who have developed malware based on the Babuk source code; and a lust for compromising ...
-
web:www.microsoft.com
The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.semanticscholar.org
A dynamic trigger generation method based on sample features, which is referred to as "BENIGN", is devised and used to contaminate and launch attacks on the model while also implementing a tailored training process to achieve specific attack objectives. The evolution of IoT malware has ignited interest in the creation of malware family classification models. Nonetheless, these models ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.