Malware Analysis - JS to PowerShell to XWorm with Binary Refinery

We deobfuscate a JScript loader that downloads a powershell script, then we unpack the payload using Binary Refinery. We decrypt the configuration of the final payload: XWorm.

Malware analysis course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=9E0FEBA1085CD0AB8036

XWorm config decrypter: https://github.com/struppigel/hedgehog-tools/tree/main/XWormRAT
Binary Refinery: https://github.com/binref/refinery
Sample: https://malshare.com/sample.php?action=detail&hash=5bc8b1a067ec4b487e88c2bb93728158633f4fdf22b111d5562cbb4ad3426d30

Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

00:00 Intro
00:40 Triage on VirusTotal
02:24 Deobfuscation of JS
09:38 Obtaining atom.xml and triage
11:37 PowerShell decrypting the injector DLL
23:03 Injector DLL triage
24:55 Decrypting XWorm
28:08 XWorm …

analysis atom binary configuration decrypt deobfuscation dll downloads injector jscript loader malware malware analysis payload powershell powershell script refinery script triage unpack virustotal xml xworm