DeadVax Malware Activity Detection

Daniel Jeremiah@daniyyell

•updated Feb 9, 2026•0•26

This rule detects activity associated with the DeadVax threat. It correlates network connections to specific malicious domains (w3s.link, mingyitc.com, ipfs.w3s, PurchaseOrder, bafybeiaj6jw2xhbppgji757tn3hg5uu6splaa5gyydkwnzwprzakcp44ve) with subsequent process creation or file modification events. Specifically, it looks for the creation of processes like 'mbs.exe' or scripts like 'rEgX.cmd', 'boot64x.w', or 'IntelDriver' within a two-hour window of the network connection. It also identifies specific command-line patterns involving 'mbs.exe' and 'rEgX.cmd' with 'Get-Content', file creations/modifications of 'boot64x.w' in 'IntelDriver' folders, creation of files ending with '_windows.dll_' in 'temp' or 'ProgramData' directories, and creation of '.bat' files in 'temp\temp' by scripting engines. Additionally, it correlates the creation of 'boot64x.w' in 'IntelDriver' with network connections to the malicious domains within a one-hour window, indicating a payload delivery followed by C2 communication.