Dead#Vax Self-Parsing Batch Script Detection

Ethan Andrews@eandrews

•updated Feb 27, 2026•1•0•21

Detects PowerShell executing a self-parsing command to extract a hidden payload from a batch file. This technique was observed in the Dead#Vax campaign. The malware reads its own batch file content to find a line starting with '@' which contains the next-stage encrypted payload.