Malware Analysis - JS to PowerShell to XWorm with Binary Refinery

We deobfuscate a JScript loader that downloads a powershell script, then we unpack the payload using Binary Refinery. We decrypt the configuration of the final payload: XWorm. Udemy course: XWorm config decrypter: Binary Refinery: Sample: Buy me a coffee: Follow me on Twitter: