> Family · letsdiskusscom_

~/packetpursuit $ cat /intel/families/letsdiskusscom.md

typeentityconfidencemediumcreated2026-06-13updated2026-06-13malware-familyloaderscriptnodejsobfuscationevasionpersistence

letsdiskusscom

OpenCTI label (letsdiskuss-com) for a Node.js dropper cluster. Two observed siblings (n=2); confidence medium. Self-contained local installer masquerading as a browser update helper. Threat vector is silent payload staging + execution, with optional registry persistence.

Overview

First observed 2026-05-26 via MalwareBazaar ingestion. The carrier is a Node.js script that drops a signed Revo Uninstaller Pro component (RevoSrp.exe) plus three signed Microsoft VC++ runtime DLLs to a fake Microsoft Edge Updates Helper directory under %ProgramData%, then silently executes the EXE. No C2 from the carrier; the malicious act is the deceptive delivery and silent execution.

Three confirmed siblings observed:

  • Sibling 9dc2cded — 1.8 MB, javascript-obfuscator string-array rotator with base64-embedded PE blobs. No persistence. ^[/intel/analyses/9dc2cded28a0dfe75fbb36a792292d30190dc5bfe7ca0ddf9b8c82e4a0774d34.html]
  • Sibling d0ca14b3 — 9.7 MB, custom 256-word English poem lookup-table steganography (no javascript-obfuscator). Adds a BAT file that writes HKCU\Run registry persistence before launching the EXE. ^[/intel/analyses/d0ca14b3ad12100898d69afacfecfbdb186fe1bd801f69aecf355413bf6e502b.html]
  • Sibling 247b54b5 — 7.9 MB, same poem lookup-table as d0ca14b3, same BAT-based persistence, same EXE/DLL2/DLL3/BAT hashes, but swaps msvcp140.dll for a smaller version (938 KB vs 1.1 MB). Third confirmed sibling. ^[/intel/analyses/247b54b524dcdd1a4dbe76ac11473ba26ea003193ad86216fe411f9b80e8c7fb.html]

Both siblings embed the same signed PE files by SHA-256, confirming payload reuse across the cluster.

Build Stack

  • Language: JavaScript (Node.js runtime target)
  • Obfuscator: Variant-dependent — javascript-obfuscator self-defend IIFE (9dc2cded) or none (d0ca14b3)
  • Encoding: Base64 string array (9dc2cded) or 256-word poem lookup-table (d0ca14b3)
  • Packaging: Raw .js file, likely delivered inside a ZIP or MSI
  • Dependencies: Victim must have Node.js installed, or the script is bundled with a portable Node.js runtime

Deploy / TTPs

ATT&CK Technique Implementation
T1059.007 JavaScript execution Node.js require('fs') + require('child_process')
T1027.002 Obfuscated Files or Info javascript-obfuscator string-array (9dc2cded) or poem-word-list steganography (d0ca14b3)
T1036.005 Masquerading Microsoft Edge Updates Helper directory name
T1547.001 Registry Run Keys BAT file calls reg add on HKCU\Software\Microsoft\Windows\CurrentVersion\Run (d0ca14b3 only)
T1543.003 Create/modify system process child_process.spawn(..., {detached: true}) or spawn(..., {shell: true})

Variants / Aliases

  • OpenCTI label: letsdiskuss-com
  • No other aliases or actor attribution observed.

Notable Analyses

  • 9dc2cded28a0dfe75fbb36a792292d30190dc5bfe7ca0ddf9b8c82e4a0774d34 — Node.js string-array dropper with signed Revo Uninstaller payload, no persistence. Report at /intel/analyses/9dc2cded28a0dfe75fbb36a792292d30190dc5bfe7ca0ddf9b8c82e4a0774d34.html.
  • d0ca14b3ad12100898d69afacfecfbdb186fe1bd801f69aecf355413bf6e502b — 9.7 MB poem-word-list dropper with BAT-based registry persistence. Report at /intel/analyses/d0ca14b3ad12100898d69afacfecfbdb186fe1bd801f69aecf355413bf6e502b.html.

Capabilities

  • nodejs-string-array-rotator-obfuscation
  • self-defend-iife-anti-deobfuscation
  • base64-embedded-pe-payload
  • poem-word-list-steganography
  • natural-language-payload-encoding
  • programdata-staging-directory
  • detached-child-process-spawn
  • shell-true-process-spawn
  • signed-payload-masquerade
  • vc++-runtime-bundling
  • no-c2-self-contained
  • registry-run-persistence-via-batch
  • batch-script-payload-launcher

Related