DeadVax Self-Parsing PowerShell Logic

Neela Ropp@Nlr

•updated Mar 10, 2026•1•37

Detects a specific PowerShell command pattern used by the DeadVax malware campaign. The malware uses a self-parsing technique to read its own batch script file and extract a hidden, encoded payload from lines starting with an '@' character.