letsdiskusscom: b4d2dda6 — Update_21.js, twenty-ninth confirmed sibling with twenty-ninth distinct msvcp140.dll morph

Executive Summary

The twenty-ninth confirmed sibling of the letsdiskusscom Node.js dropper cluster. A 9.5 MB JavaScript file (Update_21.js) uses numbered-suffix poem-word-list steganography to embed a signed Revo Uninstaller component (RevoSrp.exe) plus three VC++ runtime DLLs and a BAT-based registry persistence script. The carrier is self-contained: no network C2. Static-only analysis (CAPE skipped — JS source is not a supported binary class).^[file.txt]^[dynamic-analysis.md]

What It Is

All embedded payload hashes match the invariant set observed across all 28 prior siblings except for msvcp140.dll, which rotates for the twenty-ninth time:

How It Works

The script defines a 256-word English poem lookup table (wlist) and five encoded payload strings (exe, dll1, dll2, dll3, bat).^[strings.txt:6] The lookup table is split: indices 0–91 are plain vocabulary words; indices 92–255 are suffixed versions (gentle1, hush2, ... fail164).^[strings.txt:6] The encoded payloads use only the suffixed half, defeating naive word-frequency clustering.

At runtime, writePositionsToFile splits the lookup table, maps each payload word to its index, and writes index & 0xFF to disk as raw bytes.^[strings.txt:18-25] Files are staged to %ProgramData%\Microsoft Edge Updates Helper CN0raP8J4vup\.^[strings.txt:5]

After writing, the script spawns the BAT with shell: true, which adds HKCU\Software\Microsoft\Windows\CurrentVersion\Run persistence pointing to the EXE path, then launches the EXE.^[strings.txt:29-40] The BAT file also accepts a command-line argument for the EXE path, but the caller passes the path explicitly.^[strings.txt:40]

Decompiled Behavior

No PE decompilation performed — the carrier is JavaScript source, not a binary. The embedded RevoSrp.exe is the same signed payload analyzed in all prior siblings; see letsdiskusscom entity page for its import surface and Authenticode chain.^[entities/letsdiskusscom.md]

C2 Infrastructure

None. The sample is a fully self-contained local installer. No network URLs, IPs, domains, or callback mechanisms are present in the carrier. The threat is silent payload staging + execution + persistence, not remote C2.^[strings.txt]

Interesting Tidbits

• The Update_21.js filename continues the internal build-counter pattern observed since Update_1.js through Update_25.js. This suggests a builder that auto-increments a counter per generated sample.^[metadata.json]
• The staging directory suffix CN0raP8J4vup is a random alphanumeric string, unique per sibling, confirming builder-level randomization of the install path.^[strings.txt:5]
• The BAT payload is assigned to both autorunPath and dll4Path in the source — a minor variable-reuse quirk that does not affect execution.^[strings.txt:13-17]
• The msvcp140.dll in this sample is the twenty-ninth distinct morph, continuing the builder's practice of rotating a single DLL while keeping the EXE and other DLLs invariant. This may be an attempt to evade hash-based detection or simply a side effect of pulling the DLL from different MSVC redistributable packages.^[entities/letsdiskusscom.md]

How To Mess With It (Homelab Replication)

The poem-word-list steganography is trivial to replicate. See the Reproduce on your own VMs section at poem-word-list-steganography for a working Python encoder/decoder. To produce a sample with the same behavioral fingerprint:

1. Encode RevoSrp.exe and the three DLLs using the 256-word lookup table with numbered suffixes.
2. Wrap in a Node.js script that calls fs.mkdirSync and fs.writeFileSync.
3. Add the BAT launcher with child_process.spawn(..., {shell: true}).
4. Verify: the resulting .js should be ~7–11 MB with extremely long lines and the writePositionsToFile function signature.

Deployable Signatures

YARA

rule letsdiskusscom_poem_stego_js {
    meta:
        description = "Node.js poem-word-list steganography dropper (letsdiskusscom cluster)"
        author = "PacketPursuit"
        date = "2026-08-24"
        sha256 = "b4d2dda66b99ed120f83232168035aa60ca72ff58dd05201b14f8189b82d6236"
    strings:
        $func1 = "writePositionsToFile" ascii wide
        $func2 = "safeMakeDir" ascii wide
        $func3 = "launchExecutable" ascii wide
        $app = "Microsoft Edge Updates Helper" ascii wide
        $wlist = "gentle hush that wraps the midnight air" ascii wide
        $exePath = "Microsoft Edge Updates Helper.exe" ascii wide
        $dll1 = "msvcp140.dll" ascii wide
        $dll2 = "vcruntime140.dll" ascii wide
        $bat = "CN0raP8J4vup.bat" ascii wide
        $reg = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
    condition:
        filesize > 1MB and
        $func1 and $app and $wlist and
        3 of ($dll*, $bat, $reg)
}

Sigma

title: letsdiskusscom Node.js Dropper Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection_node:
        Image|endswith: '\node.exe'
        CommandLine|contains: 'Update_'
    selection_bat:
        ParentImage|endswith: '\node.exe'
        CommandLine|contains: 'CN0raP8J4vup.bat'
    selection_exe:
        ParentImage|endswith: '\cmd.exe'
        Image|endswith: '\Microsoft Edge Updates Helper.exe'
    condition: selection_node and (selection_bat or selection_exe)
falsepositives:
    - Unknown
level: high

IOCs

Behavioral Fingerprint

A Node.js script (typically named Update_N.js, 7–11 MB) writes five files to a fake Microsoft Edge Updates Helper directory under %ProgramData%: a 52 KB Authenticode-signed EXE (RevoSrp.exe), three Microsoft VC++ runtime DLLs, and a 440-byte BAT script. The BAT adds an HKCU\...\Run registry entry for the EXE and then launches it. The carrier contains no network C2 and no obfuscation beyond the poem-word-list encoding of the embedded binaries.

Detection Signatures

References

• letsdiskusscom — Entity page for the family (28 prior siblings)
• poem-word-list-steganography — Technique page for the 256-word poem encoding
• natural-language-payload-encoding — Concept page for prose-based payload hiding
• registry-run-persistence — Procedure page for the BAT-based Run key technique

Provenance

Analysis based on static extraction from the JavaScript carrier. Payloads decoded by replicating the writePositionsToFile index-mapping logic in Python. File-type and metadata from file and exiftool. No dynamic execution performed — CAPE skipped because the carrier is JavaScript source.^[file.txt]^[exiftool.json]^[dynamic-analysis.md]