letsdiskusscom: 71e6cb9e — Twenty-seventh confirmed sibling (Update_8.js), numbered-suffix poem steganography, twenty-seventh distinct msvcp140.dll morph

Executive Summary

Twenty-seventh confirmed sibling in the letsdiskusscom Node.js poem-word-list dropper cluster. Filename Update_8.js fills the build-counter gap between Update_5.js and Update_9.js. Uses numbered-suffix poem steganography (gentle1, hush2, etc.) with the canonical 256-word vocabulary. Drops the same signed RevoSrp.exe + vcruntime DLLs + BAT persistence as all 26 prior siblings, but carries a twenty-seventh distinct msvcp140.dll morph (879,616 bytes, MSVC 14.27.29016.0). Static-only analysis (CAPE skipped — JS source not a supported binary class).

What It Is

• File: Update_8.js, 7.5 MB (7,493,234 bytes), JavaScript source with CRLF line terminators ^[file.txt]
• Family: letsdiskusscom — confirmed 27th sibling by payload hash matching and builder template fidelity ^[entities/letsdiskusscom.md]
• Staging directory: %ProgramData%\Microsoft Edge Updates Helper 6loccZYQrhUC\ ^[strings.txt:5]
• Obfuscation: Numbered-suffix poem-word-list steganography (256-word vocabulary, words 93+ suffixed with index) ^[strings.txt:6]

How It Works

The carrier is a Node.js script that decodes five embedded payloads from a 256-word English poem via writePositionsToFile(listA, listB, outPath). The lookup table is the same poem used in all 26 prior siblings, with numbered suffixes appended to repeated words starting after the first complete cycle (index 92 = abide92). ^[strings.txt:6] ^[strings.txt:18-26]

Decoded payloads (verified by SHA-256):

The script writes all five files to the staging directory, then launches the BAT (which adds the EXE to HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and the EXE directly. ^[strings.txt:33-41]

Decompiled Behavior

Not applicable — source is unobfuscated JavaScript. No Ghidra/radare2 decompilation required. The full logic is visible in strings.txt (the file is the source). ^[strings.txt]

C2 Infrastructure

None. The dropper is self-contained — all payloads are embedded in the JS source. No network IOCs, no download URLs, no hardcoded C2. ^[strings.txt]

Interesting Tidbits

• Build-counter gap fill: Update_8.js sits between Update_5.js (b53d6a32) and Update_9.js (5ebd96a1), confirming a large batch of builds from the numbered-suffix template. ^[entities/letsdiskusscom.md]
• Twenty-seventh distinct msvcp140.dll: The builder rotates this DLL on every build while keeping the other three PE payloads constant. This suggests the msvcp140.dll is sourced from a collection of legitimate MSVC redistributables rather than being custom-built.
• Staging directory suffix 6loccZYQrhUC: Randomized per build, 12-character mixed-case alphanumeric. No dictionary words. Likely PRNG-generated.
• BAT is assigned to dll4Path: A minor code quirk — the BAT path is stored in dll4Path despite not being a DLL. The JS defines const dll4Path = path.join(folder, "6loccZYQrhUC.bat") but never uses it; the BAT is written via autorunPath instead. ^[strings.txt:17]

How To Mess With It (Homelab Replication)

1. Toolchain: Node.js v18+ on Windows or Linux
2. Encode a payload:

   with open('words.txt') as f:
       words = f.read().split()
   assert len(words) == 256
   with open('payload.exe', 'rb') as f:
       data = f.read()
   encoded = ' '.join(words[b] for b in data)
   

3. Carrier: Wrap in a Node.js script using the writePositionsToFile pattern from strings.txt.
4. Verify: Decode back to the original file and compare SHA-256.
5. What you'll learn: How natural-language steganography defeats static string analysis — the carrier looks like poetry but hides executable payloads.

Deployable Signatures

YARA

rule letsdiskusscom_poem_stego_js {
    meta:
        description = "Detects letsdiskusscom Node.js poem-word-list steganography dropper"
        author = "PacketPursuit"
        reference = "/intel/analyses/71e6cb9e217945f0ae0b071e6b30417a7f28476fe79ca7b235d11609a8172a43.html"
        date = "2026-08-24"
    strings:
        $func1 = "writePositionsToFile" ascii wide
        $func2 = "safeMakeDir" ascii wide
        $func3 = "launchExecutable" ascii wide
        $app = "Microsoft Edge Updates Helper" ascii wide
        $req_fs = "require('fs')" ascii wide
        $req_path = "require('path')" ascii wide
        $req_spawn = "require('child_process')" ascii wide
        $wlist = "const wlist =" ascii wide
        $exe = "const exe =" ascii wide
        $dll1 = "const dll1 =" ascii wide
        $bat = "const bat =" ascii wide
        $poem = "gentle hush that wraps the midnight air" ascii wide
        $spawn_shell = "shell: true" ascii wide
    condition:
        filesize > 1MB and
        all of ($func1, $func2, $func3) and
        $app and
        2 of ($req_*) and
        $wlist and
        any of ($exe, $dll1, $bat) and
        $poem
}

Sigma

title: Letsdiskusscom Node.js Dropper Execution
status: experimental
description: Detects Node.js executing a payload from a Microsoft Edge Updates Helper staging directory
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\node.exe'
    selection_child:
        Image|contains: 'ProgramData\Microsoft Edge Updates Helper'
    condition: selection_parent and selection_child
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

A Node.js script (typically named Update_N.js) defines a 256-word English poem vocabulary and five large space-separated strings encoded as word indices. It calls writePositionsToFile to decode each string to a binary file in %ProgramData%\Microsoft Edge Updates Helper <random12>\, then uses child_process.spawn with shell: true to execute a BAT file (which adds the EXE to HKCU\Run) and the EXE itself. The EXE is always the same signed RevoSrp.exe; the msvcp140.dll rotates per build.

Detection Signatures

References

• letsdiskusscom — entity page for the family
• poem-word-list-steganography — technique page for the encoding method
• registry-run-persistence — procedure page for the BAT-based Run key technique

Provenance

Analysis derived from:

• file.txt — file type identification
• strings.txt — full JavaScript source (the file is unobfuscated source code)
• triage.json — triage metadata
• exiftool.json — file metadata
• Decoded payloads verified via Node.js runtime SHA-256 computation