Malware Analysis - JS to PowerShell to XWorm with Binary Refinery

We deobfuscate a JScript loader that downloads a powershell script, then we unpack the payload using Binary Refinery. We decrypt the configuration of the final payload: XWorm. 00:00 Intro 00:40 Triage on VirusTotal 02:24 Deobfuscation of JS 09:38 Obtaining atom.xml and triage 11:37 PowerShell decrypting the injector DLL 23:03 Injector DLL triage 24:55 Decrypting XWorm 28:08 XWorm triage, config location 30:12 Configuration decryption #powershell