letsdiskusscom: c075aeba — 7.8 MB fifth poem-stego sibling with unique msvcp140.dll

A 7.8 MB Node.js dropper encoding four embedded PE payloads (one signed EXE + three signed VC++ runtime DLLs) and a BAT persistence script inside a 256-word English poem lookup table. At runtime it reconstructs the payloads by poem-word index mapping, stages them to a fake Microsoft Edge Updates Helper xp7v5lqfYx3t directory under %ProgramData%, writes a BAT that adds the EXE to HKCU\Run, then spawns the BAT and the EXE. No C2. This is the fifth confirmed sibling in the letsdiskusscom cluster.

What It Is

Build / RE

Carrier. Plain JavaScript (Node.js require surface: fs, path, child_process). No javascript-obfuscator; the entire obfuscation is the poem-word-list steganography. ^[strings.txt:1-5]

Encoding. A 256-word English poem serves as a lookup table (indices 0–255). Payloads are stored as space-separated sequences of poem words. The helper writePositionsToFile(listA, listB, outPath) splits listA, finds each listB word's index, masks to 0xFF, and writes the byte buffer. ^[strings.txt:18-26]

Embedded payloads (decoded).

Build quality. The dll4Path variable is dead code (copy-paste remnant from DLL pattern) — the BAT is written to autorunPath instead. ^[strings.txt:17]

Deploy / ATT&CK

Cluster delta. Prior siblings used detached: true, stdio: 'ignore' (9dc2cded) or shell: true with the same BAT (d0ca14b3/247b54b5/af4313e4). This sample uses shell: true, stdio: 'inherit' for both the BAT and the direct EXE launch — a minor variation that keeps the child attached to the parent's console. ^[strings.txt:30-41]

C2. None. Fully self-contained. No network references in the carrier. The Revo EXE may phone home at runtime, but that requires PE-level detonation. ^[strings.txt] ^[dynamic-analysis.md]

Deployable Signatures

YARA rule — poem-word-list Node.js dropper

rule letsdiskusscom_poem_stego_js {
    meta:
        description = "Node.js dropper using 256-word poem lookup table to encode PE payloads"
        author = "PacketPursuit"
        family = "letsdiskusscom"
    strings:
        $node_fs = "const fs = require('fs')"
        $node_path = "const path = require('path')"
        $node_spawn = "const { spawn } = require('child_process')"
        $wlist = "const wlist = "
        $func = "function writePositionsToFile"
        $mask = "p & 0xFF"
        $folder = /Microsoft Edge Updates Helper [a-zA-Z0-9]+/
    condition:
        filesize > 1MB and
        $node_fs and $node_path and $node_spawn and
        $wlist and $func and $mask and $folder
}

Behavioral hunt query — Sigma

title: Node.exe writing Microsoft Edge helper files to ProgramData
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        TargetFilename|contains:
            - 'ProgramData\Microsoft Edge Updates Helper'
            - 'Microsoft Edge Updates Helper.exe'
            - 'xp7v5lqfYx3t'
    condition: selection
falsepositives:
    - Unlikely — path is attacker-controlled random suffix
level: high

IOC list

References

• Wiki: letsdiskusscom — cluster entity page
• Technique: poem-word-list-steganography — 256-word poem encoding
• Concept: natural-language-payload-encoding — prose-based payload hiding
• Procedure: registry-run-persistence — BAT-based Run key technique
• Sibling reports: raw/analyses/9dc2cded.../report.md, raw/analyses/d0ca14b3.../report.md, raw/analyses/247b54b5.../report.md, raw/analyses/af4313e4.../report.md

Provenance

• file.txt — file utility (file type, size)
• strings.txt — static string extraction via strings -n 8
• dynamic-analysis.md — CAPE sandbox status (skipped, unsupported file class)
• floss.txt — flare-floss (error, unsupported file class)
• capa.txt — Mandiant capa (error, unsupported file class)
• Manual decode via Python re-implementation of writePositionsToFile against the raw JS source
• SHA-256 verification via hashlib.sha256 on decoded byte buffers