Dead#Vax: Multi Stage Fileless Attack Using VHD and AsyncRAT

Du'aine Davis

Observed in the wild

• A recent phishing campaign impersonating Progressive Components used IPFS‑hosted Virtual Hard Disk (VHD) files disguised as purchase orders. Once opened, the VHDs mounted locally without Mark‑of‑the‑Web restrictions, enabling a multi‑stage script chain that ran entirely in memory and ultimately delivered AsyncRAT. The activity targets organisations whose users may open disk‑image attachments or follow external download links.
• The attackers used a layered fileless methodology, moving from WSF to heavily obfuscated BAT scripts and then to encrypted PowerShell loaders. These performed anti‑VM checks, established scheduled‑task persistence, decrypted shellcode in memory, and injected it into trusted Windows processes such as RuntimeBroker or OneDrive, ensuring stealth and long‑term access.
• Organisations are advised to block or investigate unexpected VHD/ISO/IMG downloads, enable PowerShell Script Block Logging, and monitor Microsoft Defender for process‑injection APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) and unusual script execution from %TEMP% or %APPDATA%. Memory hunting should include checks for the attacker’s reinfection marker DE AD BE CA FE BA EF within legitimate processes.

Dead#Vax: Analyzing Multi-Stage VHD Delivery and Self-Parsing Batch Scripts to Deploy In-Memory Shellcode