letsdiskusscom: 2c86df65 — Update_12.js, twenty-first confirmed sibling with 21st distinct msvcp140.dll morph

Executive Summary

Twenty-first confirmed sibling in the letsdiskusscom Node.js poem-word-list dropper cluster. Filename Update_12.js (8.5 MB) continues the numbered-suffix steganography template (gentle1, hush2, etc.) and decodes to the same signed RevoSrp.exe + vcruntime DLL payload set shared by all twenty prior siblings, but introduces a twenty-first distinct msvcp140.dll morph (SHA-256 077c6dc7...). Self-contained local installer with BAT-based HKCU Run persistence. No C2. Static-only (CAPE skipped — JavaScript source not supported for detonation).

What It Is

How It Works

The script defines a 256-word lookup table (wlist) written as an English poem fragment, then encodes five binary payloads as sequences of word indices from that table ^[strings.txt:4-6]. A writePositionsToFile function performs a.indexOf(word) lookups and writes index & 0xFF bytes to disk ^[strings.txt:18-25].

Decoded payloads:

The staging directory is %ProgramData%\Microsoft Edge Updates Helper dZiDIakVihSz ^[strings.txt:5]. After writing files, the script spawns the BAT with the EXE path as argument, then spawns the EXE directly ^[strings.txt:33-41].

The BAT adds an HKCU Run registry entry pointing to the EXE ^[strings.txt:11].

Steganography variant: Of the 256 words in wlist, 164 carry numbered suffixes (gentle1, hush2, that3 ... fail164) ^[strings.txt:6]. This poisons frequency-analysis tools while preserving the encoding semantics — a.indexOf(word) still resolves correctly because each suffixed token is unique in the lookup table.

C2 Infrastructure

None. The dropper is entirely self-contained; no network calls, no download URLs, no C2 beacons. The threat is the silent payload staging and execution of a signed Revo Uninstaller component under a deceptive directory name.

Interesting Tidbits

• Build-counter filename: Update_12.js continues the Update_N.js naming pattern seen in siblings Update_3.js through Update_25.js, suggesting an internal build counter or campaign wave tracker.
• 21st distinct msvcp140.dll: The msvcp140.dll SHA-256 077c6dc7... does not match any of the twenty prior siblings, confirming the builder actively rotates this runtime DLL while reusing the same signed EXE and vcruntime pair.
• Same signed payload: The EXE retains its DigiCert Authenticode signature (PKCS#7 overlay, 19,120 bytes) and RevoSrp.pdb path, confirming it is the legitimate Revo Uninstaller Pro component repurposed as a masquerade payload.
• No obfuscation beyond steganography: Unlike the first sibling (9dc2cded) which used javascript-obfuscator, this sample has no IIFE wrappers, no string-array rotation, no self-defend — just the poem encoding.

Deployable Signatures

YARA rule

rule letsdiskusscom_poem_dropper {
    meta:
        description = "Node.js poem-word-list dropper (letsdiskusscom cluster)"
        author = "PacketPursuit"
        date = "2026-08-23"
        sha256 = "2c86df65c4976ae885860d5c8568d545d47e50989e4008f34cb486b0f0eeb327"
    strings:
        $js_fs = "const fs = require('fs');" ascii wide
        $js_path = "const path = require('path');" ascii wide
        $js_spawn = "const { spawn } = require('child_process');" ascii wide
        $app_name = "Microsoft Edge Updates Helper" ascii wide
        $func_write = "function writePositionsToFile(listA, listB, outPath)" ascii wide
        $wlist = "const wlist = \"gentle hush that wraps the midnight air" ascii wide
        $exe = "const exe = \"unwearied tides candle53" ascii wide
        $safeMakeDir = "function safeMakeDir(dir)" ascii wide
        $launch = "function launchExecutable" ascii wide
    condition:
        filesize > 5MB and
        filesize < 15MB and
        4 of ($js_*) and
        $app_name and
        $func_write and
        $wlist and
        $exe
}

Sigma rule

title: Node.js poem-word-list dropper execution
description: Detects Node.js scripts spawning EXEs from ProgramData with Microsoft Edge masquerade
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|contains:
            - 'node.exe'
            - 'Update_*.js'
        - ParentImage|endswith: 'node.exe'
    spawn:
        - Image|endswith:
            - 'Microsoft Edge Updates Helper.exe'
            - 'RevoSrp.exe'
        - CommandLine|contains: 'Microsoft Edge Updates Helper'
    condition: selection and spawn
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint

This 8.5 MB JavaScript file defines a 256-word lookup table (an English poem fragment), encodes five binary payloads as word-index sequences, and uses writePositionsToFile to decode them to %ProgramData%\Microsoft Edge Updates Helper <random_suffix>\. It writes a signed RevoSrp.exe, three VC++ runtime DLLs, and a BAT persistence script, then spawns both the BAT and EXE. The BAT adds an HKCU Run registry entry. No network C2. File naming follows Update_N.js build-counter pattern.

Detection Signatures

References

• letsdiskusscom — Entity page for the family
• poem-word-list-steganography — Technique page for the 256-word poem encoding
• natural-language-payload-encoding — Concept page for prose-based payload hiding
• registry-run-persistence — Procedure page for the BAT-based Run key technique

Provenance

• file.txt — file(1) output (GNU file 5.44)
• strings.txt — raw JavaScript source (8.5 MB, line-extracted via strings)
• exiftool.json — ExifTool 12.76 metadata
• triage.json — triage-fast pipeline output (schema v1)
• dynamic-analysis.md — CAPE skipped (JS source not supported)
• Decoded payload SHA-256s computed via Python 3.12 hashlib.sha256() from word-list index reconstruction