Dead#Vax Self-Parsing Script Payload Extraction

Ernesto Lleras@ernesto

•updated Mar 10, 2026•1•0•41

Detects a PowerShell command used to read its own batch script container (e.g., rEgX.cmd) to find and extract a hidden, encoded payload. This self-parsing technique is a core feature of the Dead#Vax malware.