DeadVax Self-Parsing Script Payload Extraction

Aaron Beardslee@abeardslee

•updated Mar 10, 2026•0•72

Detects a PowerShell process reading the content of a batch script named 'rEgX.cmd' to extract an appended payload. This technique is used by the DeadVax malware as part of its stage 3 execution.