ae2e9acd01f8461549455df96fdfef3a28e8846839e596d8ea15c2ea8e4198acBuild / RE
Carrier: Node.js JavaScript (Update_3.js), 9.6 MB, 60 lines, CRLF terminators ^[file.txt]. Not a PE; capa and floss skipped ^[capa.txt] ^[floss.txt]. binwalk reports no embedded artifacts ^[binwalk.txt].
Obfuscation: 256-word English poem lookup-table steganography with numbered suffixes on repeated vocabulary (gentle1, hush2, ... fail164) ^[strings.txt:5-6]. This is the numbered-suffix builder template first observed in sibling 3465e6ee and reverted in 5126076d, ddcb25ee, and 2274d74f; this sample reintroduces it, confirming at least two parallel builder templates in active rotation.
Embedded payloads decoded (PE32+ x64, EXE + 3 DLLs + BAT):
RevoSrp.exe— Signed VS Revo Group, Jun 2025. System restore point utility. Legitimate binary abused as decoy/LOLBIN. SHA-2568b94af60....msvcp140.dll— MSVC 14.27.29016.0, Jun 2020, 1,174,528 bytes, SHA-25637986327.... Unsigned. Tenth distinctmsvcp140.dllmorph in the cluster.vcruntime140.dll— Signed Microsoft, Jun 2020. SHA-256ff43e813....vcruntime140_1.dll— Signed Microsoft, Jun 2020. SHA-2567b8f70dd....XNFRuLysfDpL.bat— HKCU Run persistence script. SHA-256dff20059....
No packing, no anti-analysis, no VM checks. Code quality is crude but effective. The Revo EXE and both vcruntime DLLs match prior siblings byte-for-byte; only msvcp140.dll and the staging directory suffix vary.
Deploy / ATT&CK
| Technique | ID | Implementation |
|---|---|---|
| JavaScript execution | T1059.007 | Node.js require('fs') + require('child_process') |
| Obfuscated files | T1027.002 | 256-word poem lookup-table steganography |
| Masquerading | T1036.005 | Microsoft Edge Updates Helper directory under %ProgramData% |
| Registry Run persistence | T1547.001 | BAT calls reg add HKCU\...\Run pointing to staged EXE |
| Process creation | T1543.003 | spawn(..., {shell: true, stdio: 'inherit'}) |
The script writes five files to %ProgramData%\Microsoft Edge Updates Helper XNFRuLysfDpL\, then launches the BAT (which adds the EXE to HKCU Run) followed by the EXE itself ^[strings.txt:33-40]. No C2; fully self-contained installer.
Attribution
High-confidence [letsdiskusscom](/intel/families/letsdiskusscom.html) cluster sibling (n=10). All ten poem-stego siblings share the same signed Revo EXE and two vcruntime DLLs by SHA-256; only msvcp140.dll and the staging directory suffix vary per build. This sample oscillates back to the numbered-suffix builder template after three plain-template siblings, suggesting parallel build pipelines or campaign-level template rotation.