> Family · letsdiskusscom_

~/packetpursuit $ cat /intel/families/letsdiskusscom.md

title: letsdiskusscom updated: 2026-08-24

type: entity tags: [malware-family, loader, script, nodejs, obfuscation, evasion, persistence] confidence: high sources:

  • /intel/analyses/9dc2cded28a0dfe75fbb36a792292d30190dc5bfe7ca0ddf9b8c82e4a0774d34.html
  • /intel/analyses/d0ca14b3ad12100898d69afacfecfbdb186fe1bd801f69aecf355413bf6e502b.html
  • /intel/analyses/247b54b524dcdd1a4dbe76ac11473ba26ea003193ad86216fe411f9b80e8c7fb.html
  • /intel/analyses/af4313e419edc4c30356ace47af9cb11a70c8b836451ef5ab8414d0bac91fd3a.html
  • /intel/analyses/c075aeba57f002acf9e317f9bde29914031090de3444718af334a39d8cf0651d.html
  • /intel/analyses/3465e6eea1a937b941ef77ac819591c3578e14da950de0d78e8b2d467b819357.html
  • /intel/analyses/5126076d59dd812f922dedd8fcc4a43e5dbe383a412b094ab275079ccb820a3e.html
  • /intel/analyses/ddcb25ee4715a186558c8bf9540929049d9d69e0fe23d15ef885e71327d217a1.html
  • /intel/analyses/2274d74fcc2ad81b9c41c4ca578be6f252a34aaa858020bdaa07eb34e2cd196b.html
  • /intel/analyses/ae2e9acd01f8461549455df96fdfef3a28e8846839e596d8ea15c2ea8e4198ac.html
  • /intel/analyses/70862e4de4bdab9b3b4980b090982baa022cedc03f4d839260bb20bb179eced8.html
  • /intel/analyses/ff3ae2e72f50037153c943205f4d6fa90a756763e15b2cb8a5d09f8afeb06253.html
  • /intel/analyses/1fbaf8ab9f90dc7288b2dfa77d12c22452f162046134750036bdafc8d7500bbc.html
  • /intel/analyses/26155786a8e0ff9745f18589d31cce9be1f5af922ca0840532b0d1ab0e9db675.html
  • /intel/analyses/c485dd9c6d810f36618315d661ecb801f4ef8d44ef9946876a4649ed8c23c15e.html
  • /intel/analyses/b23bb560a20c587c6888813fc06a53d4eac46af78a3813fdeefa6b6667176024.html
  • /intel/analyses/a27bda8928aaf0601341d9121c429a501a74260dd37c89754c2bb4288fda572a.html
  • /intel/analyses/7d47ca60c6ec500c39868a79cdd15d3af2c35221b52aff6a4976e58dca47748a.html
  • /intel/analyses/b53d6a322a6e3c935e10e363df1b18b7a911e944e4648c6b1e9abf2d703e918f.html
  • /intel/analyses/4c57911f992d2760d089820ec5a73be433aa4f91a656f241b7fc980c98b0ba8e.html
  • /intel/analyses/2c86df65c4976ae885860d5c8568d545d47e50989e4008f34cb486b0f0eeb327.html
  • /intel/analyses/bf5c69a56fc70007f898f34ecc1395c3766069af5592da2eaf69c02ece396982.html
  • /intel/analyses/5ebd96a1eb9cf6179dc7ea68b5b221c7aab22c460567071a930a11a24cd03f8b.html
  • /intel/analyses/bfc9e6e703793e0fd480b98a95351d1b3b5c64bcf6ecf0afece8064a8954b316.html
  • /intel/analyses/adc5a0b48efb808930acadd51091509e481512446aac030a367d4577be861eb2.html
  • /intel/analyses/50a8668bad8043c6fa7610f0fc8bb119dd998e183f20a15e78f32efee108a753.html
  • /intel/analyses/71e6cb9e217945f0ae0b071e6b30417a7f28476fe79ca7b235d11609a8172a43.html
  • /intel/analyses/7d9ac86521aba5d8989dd21ed08ab3b138c7aeb4dd41bf8566c10d3d240f55a1.html
  • /intel/analyses/b4d2dda66b99ed120f83232168035aa60ca72ff58dd05201b14f8189b82d6236.html

letsdiskusscom

OpenCTI label (letsdiskuss-com) for a Node.js dropper cluster. Twenty-nine confirmed siblings (n=29); confidence high. Self-contained local installer masquerading as a browser update helper. Threat vector is silent payload staging + execution, with optional registry persistence.

Overview

All twenty-five siblings embed the same signed Revo EXE and two vcruntime DLLs by SHA-256, confirming payload reuse across the cluster. The msvcp140.dll version varies per build.

First observed 2026-05-26 via MalwareBazaar ingestion. The carrier is a Node.js script that drops a signed Revo Uninstaller Pro component (RevoSrp.exe) plus three signed Microsoft VC++ runtime DLLs to a fake Microsoft Edge Updates Helper directory under %ProgramData%, then silently executes the EXE. No C2 from the carrier; the malicious act is the deceptive delivery and silent execution.

Twenty-five confirmed siblings observed:

  • Sibling 9dc2cded — 1.8 MB, javascript-obfuscator string-array rotator with base64-embedded PE blobs. No persistence. ^[/intel/analyses/9dc2cded28a0dfe75fbb36a792292d30190dc5bfe7ca0ddf9b8c82e4a0774d34.html]

  • Sibling d0ca14b3 — 9.7 MB, custom 256-word English poem lookup-table steganography (no javascript-obfuscator). Adds a BAT file that writes HKCU\Run registry persistence before launching the EXE. ^[/intel/analyses/d0ca14b3ad12100898d69afacfecfbdb186fe1bd801f69aecf355413bf6e502b.html]

  • Sibling 247b54b5 — 7.9 MB, same poem lookup-table as d0ca14b3, same BAT-based persistence, same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for a smaller version (938 KB vs 1.1 MB). Third confirmed sibling. ^[/intel/analyses/247b54b524dcdd1a4dbe76ac11473ba26ea003193ad86216fe411f9b80e8c7fb.html]

  • Sibling af4313e4 — 9.4 MB, same poem lookup-table, same BAT-based persistence, same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for a fourth distinct version (1,138,176 B, SHA-256 cf964e01...). Fourth confirmed sibling. ^[/intel/analyses/af4313e419edc4c30356ace47af9cb11a70c8b836451ef5ab8414d0bac91fd3a.html]

  • Sibling c075aeba — 7.8 MB, same poem lookup-table and BAT persistence, same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for a fifth distinct version (956,416 B, SHA-256 2ee431f4...). Fifth confirmed sibling. ^[/intel/analyses/c075aeba57f002acf9e317f9bde29914031090de3444718af334a39d8cf0651d.html]

  • Sibling 3465e6ee — 7.9 MB, same poem lookup-table and BAT persistence, same EXE/DLL2/DLL3/BAT hashes, but introduces numbered suffixes on repeated vocabulary (gentle1, hush2, etc.) and swaps msvcp140.dll for a sixth distinct version (932,864 B, SHA-256 5975596f...). Sixth confirmed sibling. ^[/intel/analyses/3465e6eea1a937b941ef77ac819591c3578e14da950de0d78e8b2d467b819357.html]

  • Sibling 5126076d — 9.1 MB, reverts to plain 256-word poem (no numbered suffixes), same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for a seventh distinct version (1,108,480 B, SHA-256 896fd62b..., MSVC 14.27.29016.0). Seventh confirmed sibling. Evidence of at least two parallel builder templates (plain vs. numbered-suffix). ^[/intel/analyses/5126076d59dd812f922dedd8fcc4a43e5dbe383a412b094ab275079ccb820a3e.html]

  • Sibling ddcb25ee — 7.5 MB, plain 256-word poem (reverts from numbered suffixes), same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for an eighth distinct version (889,344 B, SHA-256 696b6350..., MSVC 14.40.33807.0, Jun 2025 timestamp). Eighth confirmed sibling. ^[/intel/analyses/ddcb25ee4715a186558c8bf9540929049d9d69e0fe23d15ef885e71327d217a1.html]

  • Sibling 2274d74f — 9.3 MB, plain 256-word poem, same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for a ninth distinct version (1,126,912 B, SHA-256 5bce8c8b..., MSVC 14.27.29016.0, 2020-06-16 timestamp). Staging directory suffix GQYJq5Av3lIJ. Ninth confirmed sibling. ^[/intel/analyses/2274d74fcc2ad81b9c41c4ca578be6f252a34aaa858020bdaa07eb34e2cd196b.html]

  • Sibling ae2e9acd — 9.6 MB (Update_3.js), numbered-suffix poem steganography (gentle1, hush2, etc.) reintroduced after three plain-template siblings. Same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for a tenth distinct version (1,174,528 B, SHA-256 37986327..., MSVC 14.27.29016.0, 2020-06-16 timestamp). Staging directory suffix XNFRuLysfDpL. Tenth confirmed sibling. Confirms active rotation between plain and numbered-suffix builder templates. ^[/intel/analyses/ae2e9acd01f8461549455df96fdfef3a28e8846839e596d8ea15c2ea8e4198ac.html]

  • Sibling 70862e4de4bd — 8.3 MB (Update_13.js), numbered-suffix poem steganography continuing the template from ae2e9acd. Same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for an eleventh distinct version (995,840 B, SHA-256 dd6dc081..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix DQetZUqpCbsl. Filename Update_13.js suggests an internal build counter. Eleventh confirmed sibling. ^[/intel/analyses/70862e4de4bdab9b3b4980b090982baa022cedc03f4d839260bb20bb179eced8.html]

  • Sibling ff3ae2e72f50 — 9.0 MB (Update_22.js), numbered-suffix poem steganography (gentle1 through fail164). Same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for a twelfth distinct version (1,097,728 B, SHA-256 24abac6f..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix cs3GSg6r7qBT. Filename Update_22.js continues the build-counter pattern. Twelfth confirmed sibling. ^[/intel/analyses/ff3ae2e72f50037153c943205f4d6fa90a756763e15b2cb8a5d09f8afeb06253.html]

  • Sibling 1fbaf8ab9f90 — 9.0 MB (Update_25.js), numbered-suffix poem steganography continuing template. Same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for a thirteenth distinct version (1,089,536 B, SHA-256 ce73fdee..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix 9lra5SvMi38U. Filename Update_25.js continues build counter. Thirteenth confirmed sibling. ^[/intel/analyses/1fbaf8ab9f90dc7288b2dfa77d12c22452f162046134750036bdafc8d7500bbc.html]

  • Sibling 26155786a8e0 — 7.5 MB (Update_16.js), numbered-suffix poem steganography continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all prior siblings, but swaps msvcp140.dll for a fourteenth distinct version (876,032 B, SHA-256 9b9faac1..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix iRRSX1DkpmRS. Filename Update_16.js continues the build-counter pattern. Fourteenth confirmed sibling. ^[/intel/analyses/26155786a8e0ff9745f18589d31cce9be1f5af922ca0840532b0d1ab0e9db675.html]

  • Sibling c485dd9c — 8.2 MB (Update.js), numbered-suffix poem steganography (gentle1, hush2, etc.) continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 14 prior siblings, but swaps msvcp140.dll for a fifteenth distinct version (969,728 B, SHA-256 832c1425..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix WG4n5KCoqYf0. Filename is plain Update.js (no build counter), differing from the Update_N.js pattern seen in prior waves. Fifteenth confirmed sibling. ^[/intel/analyses/c485dd9c6d810f36618315d661ecb801f4ef8d44ef9946876a4649ed8c23c15e.html]

  • Sibling b23bb560 — 8.4 MB (Update_19.js), numbered-suffix poem steganography continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 15 prior siblings, but swaps msvcp140.dll for a sixteenth distinct version (1,006,592 B, SHA-256 f5324faf..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix z624TzPkJS1N. Filename Update_19.js resumes the build-counter pattern after the plain Update.js wave. Sixteenth confirmed sibling. ^[/intel/analyses/b23bb560a20c587c6888813fc06a53d4eac46af78a3813fdeefa6b6667176024.html]

  • Sibling a27bda89 — 10.1 MB (Update_14.js), numbered-suffix poem steganography continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 16 prior siblings, but swaps msvcp140.dll for a seventeenth distinct version (1,248,256 B, SHA-256 012212f9..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix 9yyM0KCwtOI5. Filename Update_14.js continues the build-counter pattern. Seventeenth confirmed sibling. ^[/intel/analyses/a27bda8928aaf0601341d9121c429a501a74260dd37c89754c2bb4288fda572a.html]

  • Sibling 7d47ca60 — 7.7 MB (Update_18.js), numbered-suffix poem steganography continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 17 prior siblings, but swaps msvcp140.dll for an eighteenth distinct version (904,192 B, SHA-256 23bf2a4543384cc3032e25136bb7f6be801eb9d483f545c543fde0936271829b). Staging directory suffix b7mqJjEYdRYn. Filename Update_18.js continues the build-counter pattern. Eighteenth confirmed sibling. Smallest in the poem-stego cohort by file size. ^[/intel/analyses/7d47ca60c6ec500c39868a79cdd15d3af2c35221b52aff6a4976e58dca47748a.html]

  • Sibling b53d6a32 — 9.2 MB (Update_5.js), numbered-suffix poem steganography continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 18 prior siblings, but swaps msvcp140.dll for a nineteenth distinct version (1,111,040 B, SHA-256 e0cbefc3799603bc3475c90e35b49250f07d4cf4d0d0923279085d43c9ba7923, MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix QtFBwjcAMBke. Filename Update_5.js continues the build-counter pattern. Nineteenth confirmed sibling. ^[/intel/analyses/b53d6a322a6e3c935e10e363df1b18b7a911e944e4648c6b1e9abf2d703e918f.html]

  • Sibling 4c57911f — 7.7 MB (Update_15.js), numbered-suffix poem steganography continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 19 prior siblings, but swaps msvcp140.dll for a twentieth distinct version (907,776 B, SHA-256 c8f3989934455b62a700cdb450b24b476305c3e747282ac905c1e9c49ecd7678). Staging directory suffix tge9KnkgpkOY. Filename Update_15.js continues the build-counter pattern. Twentieth confirmed sibling. Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/4c57911f992d2760d089820ec5a73be433aa4f91a656f241b7fc980c98b0ba8e.html]

  • Sibling 2c86df65 — 8.5 MB (Update_12.js), numbered-suffix poem steganography (gentle1, hush2, etc.) continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 20 prior siblings, but swaps msvcp140.dll for a twenty-first distinct version (1,012,224 B, SHA-256 077c6dc7..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix dZiDIakVihSz. Filename Update_12.js continues the build-counter pattern. Twenty-first confirmed sibling. Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/2c86df65c4976ae885860d5c8568d545d47e50989e4008f34cb486b0f0eeb327.html]

  • Sibling bf5c69a5 — 9.3 MB (Update_1.js), numbered-suffix poem steganography (gentle1, hush2, etc.) continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 21 prior siblings, but swaps msvcp140.dll for a twenty-second distinct version (1,124,352 B, SHA-256 179e8ba0...). Staging directory suffix M9vpjZOcWDna. Filename Update_1.js is the lowest build-counter value observed in the cluster, suggesting early wave or fresh builder reset. Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/bf5c69a56fc70007f898f34ecc1395c3766069af5592da2eaf69c02ece396982.html]

  • Sibling 5ebd96a1 — 9.2 MB (Update_9.js), numbered-suffix poem steganography (gentle1, hush2, etc.) continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 22 prior siblings, but swaps msvcp140.dll for a twenty-third distinct version (1,119,232 B, SHA-256 72e5b6aa..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix CLTNCl7Ekb2U. Filename Update_9.js fills a gap in the build-counter sequence (between Update_5.js and Update_12.js), suggesting a large batch of builds from this template. Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/5ebd96a1eb9cf6179dc7ea68b5b221c7aab22c460567071a930a11a24cd03f8b.html]

  • Sibling bfc9e6e7 — 11 MB (Update_4.js), numbered-suffix poem steganography (gentle1, hush2, etc.) continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 23 prior siblings, but swaps msvcp140.dll for a twenty-fourth distinct version (1,378,304 B, SHA-256 d58de9dc9a1404d1597ba8c68e9a284cd302c08cc244f559ee5cb2aa75444bb9, MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix vIQNgHpMmTiD. Filename Update_4.js fills the build-counter gap between Update_1.js and Update_5.js. Largest confirmed sibling by file size (11,086,748 bytes). Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/bfc9e6e703793e0fd480b98a95351d1b3b5c64bcf6ecf0afece8064a8954b316.html]

  • Sibling 7d9ac865 — 8.8 MB (Update_24.js), numbered-suffix poem steganography (gentle1, hush2, etc.) continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 27 prior siblings, but swaps msvcp140.dll for a twenty-eighth distinct version (1,063,936 B, SHA-256 abce40f1...ad3f852, MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix DneCMKUGkQqy. Filename Update_24.js continues the build-counter pattern. Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/7d9ac86521aba5d8989dd21ed08ab3b138c7aeb4dd41bf8566c10d3d240f55a1.html]

  • Sibling b4d2dda6 — 9.5 MB (Update_21.js), numbered-suffix poem steganography (gentle1, hush2, etc.) continuing the active template. Same EXE/DLL2/DLL3/BAT hashes as all 28 prior siblings, but swaps msvcp140.dll for a twenty-ninth distinct version (1,161,216 B, SHA-256 7f0888f5..., MSVC 14.27.29016.0, compiled 2020-06-16). Staging directory suffix CN0raP8J4vup. Filename Update_21.js fills the build-counter gap between Update_19.js and Update_22.js. Twenty-ninth confirmed sibling. Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/b4d2dda66b99ed120f83232168035aa60ca72ff58dd05201b14f8189b82d6236.html]

Build Stack

  • Language: JavaScript (Node.js runtime target)
  • Obfuscator: Variant-dependent — javascript-obfuscator self-defend IIFE (9dc2cded) or none (d0ca14b3)
  • Encoding: Base64 string array (9dc2cded) or 256-word poem lookup-table (d0ca14b3)
  • Packaging: Raw .js file, likely delivered inside a ZIP or MSI
  • Dependencies: Victim must have Node.js installed, or the script is bundled with a portable Node.js runtime

Deploy / TTPs

ATT&CK Technique Implementation
T1059.007 JavaScript execution Node.js require('fs') + require('child_process')
T1027.002 Obfuscated Files or Info javascript-obfuscator string-array (9dc2cded) or poem-word-list steganography (d0ca14b3)
T1036.005 Masquerading Microsoft Edge Updates Helper directory name
T1547.001 Registry Run Keys BAT file calls reg add on HKCU\Software\Microsoft\Windows\CurrentVersion\Run (d0ca14b3 only)
T1543.003 Create/modify system process child_process.spawn(..., {detached: true}) or spawn(..., {shell: true})

Variants / Aliases

  • OpenCTI label: letsdiskuss-com
  • No other aliases or actor attribution observed.

Notable Analyses

  • 9dc2cded28a0dfe75fbb36a792292d30190dc5bfe7ca0ddf9b8c82e4a0774d34 — Node.js string-array dropper with signed Revo Uninstaller payload, no persistence. Report at /intel/analyses/9dc2cded28a0dfe75fbb36a792292d30190dc5bfe7ca0ddf9b8c82e4a0774d34.html.

  • d0ca14b3ad12100898d69afacfecfbdb186fe1bd801f69aecf355413bf6e502b — 9.7 MB poem-word-list dropper with BAT-based registry persistence. Report at /intel/analyses/d0ca14b3ad12100898d69afacfecfbdb186fe1bd801f69aecf355413bf6e502b.html.

  • bf5c69a56fc70007f898f34ecc1395c3766069af5592da2eaf69c02ece396982 — 9.3 MB poem-word-list dropper (Update_1.js), twenty-second confirmed sibling, twenty-second distinct msvcp140.dll morph. Report at /intel/analyses/bf5c69a56fc70007f898f34ecc1395c3766069af5592da2eaf69c02ece396982.html.

  • 5ebd96a1eb9cf6179dc7ea68b5b221c7aab22c460567071a930a11a24cd03f8b — 9.2 MB poem-word-list dropper (Update_9.js), twenty-third confirmed sibling, twenty-third distinct msvcp140.dll morph, build-counter gap fill between Update_5.js and Update_12.js. Report at /intel/analyses/5ebd96a1eb9cf6179dc7ea68b5b221c7aab22c460567071a930a11a24cd03f8b.html.

  • bfc9e6e703793e0fd480b98a95351d1b3b5c64bcf6ecf0afece8064a8954b316 — 11 MB poem-word-list dropper (Update_4.js), twenty-fourth confirmed sibling, twenty-fourth distinct msvcp140.dll morph (1,378,304 B), build-counter gap fill between Update_1.js and Update_5.js. Largest confirmed sibling by file size. Report at /intel/analyses/bfc9e6e703793e0fd480b98a95351d1b3b5c64bcf6ecf0afece8064a8954b316.html.

  • Sibling adc5a0b48efb — 7.8 MB poem-word-list dropper (Update_23.js), twenty-fifth confirmed sibling, twenty-fifth distinct msvcp140.dll morph (915,968 B, MSVC 14.27.29016.0), build-counter gap fill between Update_22.js and Update_25.js. Staging directory suffix P0fUY3DjdXfI. Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/adc5a0b48efb808930acadd51091509e481512446aac030a367d4577be861eb2.html]

  • Sibling 50a8668bad80 — 7.4 MB poem-word-list dropper (Update_6.js), twenty-sixth confirmed sibling, twenty-sixth distinct msvcp140.dll morph (869,888 B, MSVC 14.27.29016.0), build-counter gap fill between Update_5.js and Update_9.js. Staging directory suffix jlEFdrhYiMC4. Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/50a8668bad8043c6fa7610f0fc8bb119dd998e183f20a15e78f32efee108a753.html]

  • Sibling 71e6cb9e2179 — 7.5 MB poem-word-list dropper (Update_8.js), twenty-seventh confirmed sibling, twenty-seventh distinct msvcp140.dll morph (879,616 B, SHA-256 0d9818e4dfc4d93fbd59fda5ba1a8e58d7f4a714c4630572012ece43418ab91d, MSVC 14.27.29016.0, compiled 2020-06-16). Build-counter gap fill between Update_5.js and Update_9.js. Staging directory suffix 6loccZYQrhUC. Same signed Revo EXE + vcruntime DLLs + BAT HKCU Run persistence as all 26 prior siblings. Static-only (CAPE skipped — JS source not supported). ^[/intel/analyses/71e6cb9e217945f0ae0b071e6b30417a7f28476fe79ca7b235d11609a8172a43.html]

Capabilities

  • nodejs-string-array-rotator-obfuscation
  • self-defend-iife-anti-deobfuscation
  • base64-embedded-pe-payload
  • poem-word-list-steganography
  • numbered-suffix-poem-vocabulary-obfuscation
  • natural-language-payload-encoding
  • programdata-staging-directory
  • detached-child-process-spawn
  • shell-true-process-spawn
  • signed-payload-masquerade
  • vc++-runtime-bundling
  • no-c2-self-contained
  • registry-run-persistence-via-batch
  • batch-script-payload-launcher
  • twenty-nine-distinct-msvcp140-morphs (sample b4d2dda6, Update_21.js, 29th distinct morph at 1,161,216 B)
  • twenty-eight-distinct-msvcp140-morphs (sample 7d9ac865, Update_24.js, 28th distinct morph at 1,063,936 B)
  • twenty-seven-distinct-msvcp140-morphs (sample 71e6cb9e2179, Update_8.js, 27th distinct morph at 879,616 B)
  • twenty-six-distinct-msvcp140-morphs (sample 50a8668bad80, Update_6.js, 26th distinct morph at 869,888 B)
  • twenty-five-distinct-msvcp140-morphs (sample adc5a0b48efb, Update_23.js, 25th distinct morph at 915,968 B)
  • twenty-four-distinct-msvcp140-morphs (sample bfc9e6e7, Update_4.js, largest confirmed sibling at 11 MB)

Related