> Family · Unclassified JS WebDAV Dropper_

~/packetpursuit $ cat /intel/families/unclassified-js-webdav-dropper.md

typeentityfamilyunclassified-js-webdav-dropperconfidencehighcreated2026-06-14updated2026-07-22scriptdropperc2obfuscationdefense-evasionexecution

Unclassified JS WebDAV Dropper

Windows batch/WebDAV dropper family that uses JScript, batch, or polyglot execution to mount a remote WebDAV share and silently register a DLL via regsvr32 /s or rundll32 over a UNC path (\\host@port\DavWWWRoot\). Ninety-four confirmed siblings with distinct obfuscation dialects and different C2 infrastructure. Updated 2026-07-23 with 8323305a (100-entry random-noise dictionary, vyfrnbw object, direct WScript.Shell.run() execution without PowerShell wrapper on 94.159.113.84:8888).

Capabilities

  • polyglot-js-batch-dual-execution

  • batch-set-variable-expansion-obfuscation

  • shared-prefix-set-variable-names

  • natural-language-set-variable-names

  • wscript-shell-self-replication

  • webdav-unc-mount-payload-fetch

  • regsvr32-silent-dll-registration

  • rundll32-webdav-dll-proxy-execution

  • powershell-hidden-wrapper-execution

  • wordpad-decoy-launch

  • js-dictionary-char-lookup-obfuscation

  • function-return-this-global-construction

  • expanded-word-salad-padding

  • no-sandbox-gate-execution

  • dual-domain-c2-split-mount-vs-fetch

  • no-persistence-one-shot

  • jscript-batch-polyglot-self-replication

  • shared-prefix-set-variable-dual-layer

  • expanded-word-salad-padding-4x-volume

  • random-noise-set-variable-obfuscation

  • random-noise-dictionary-62-entry

  • rundll32-comma-entry-execution

  • three-line-minimal-footprint

  • separate-decoy-line-execution

  • extreme-variable-name-padding-2478-char

  • noise-variable-jscript-concatenation

  • random-noise-dictionary-100-entry

  • jscript-sequential-variable-reassignment-eval

  • extreme-variable-name-padding-1794-char

  • random-noise-dictionary-62-entry-rundll32-entry

  • rundll32-comma-entry-execution

  • random-noise-dictionary-100-entry-pacwwujsea — fifth 100-entry dictionary variant in family; pacwwujsea object name. Observed in f51f6323. ^[/intel/analyses/f51f632334bdfc53089666cd749bae9a890ca9333c9f5427b7fb5fe8ee901d7d.html]

  • extreme-variable-name-padding-534-char

  • random-noise-dictionary-62-entry-encodedcommand-powershell

  • extreme-variable-name-padding-2337-char

  • timeout-anti-emulation-gate

  • random-noise-dictionary-62-entry-rundll32-entry

  • extreme-variable-name-padding-1255-char

  • random-noise-dictionary-62-entry-encodedcommand-powershell

  • noise-variable-jscript-concatenation-65-entry — third confirmed pure-JScript noise-variable concatenation variant (65 entries). Same C2 subnet as fa8c6d74 (64 entries) and ddf0c8bd (65 entries). Observed in 82d78891aa. ^[/intel/analyses/82d78891aa1902262443dc4559d453af73f4567c03db9aa15e82bcfc2a312c46.html]

  • extreme-variable-name-padding-3787-char

|- extreme-variable-name-padding-1268-char |- random-noise-dictionary-62-entry-timeout-gate |- js-noise-variable-reassignment-concat-hybrid — first sibling combining sequential reassignment + noise-variable concatenation. 212 assignments, 64 identifiers, last-wins semantics. Observed in edfb0e0a. ^[/intel/analyses/edfb0e0abb507013faf97c63f4ec0f75acd3883cf1a7abb8b727f09eaeb42c92.html] |- extreme-variable-name-padding-3395-char-rundll32-entry — fourth-longest variable name in family (3,395 chars); rundll32 ...,Entry execution on 94.159.113.86:8888. Observed in f346e80d. ^[/intel/analyses/f346e80d14c241f4d015911188f474a9ce8f8aad603413b36107c281899fbc39.html] |- extreme-variable-name-padding-3451-char — third-longest variable name in family (3,451 chars). Observed in f2316aaf. ^[/intel/analyses/f2316aaf552b9926fa8c3398e3d15a3a770e320033d03e9546ff9d9cb29aaf9f.html] |- rundll32-comma-entry-execution-no-powershell-no-decoy — minimal execution: no PowerShell wrapper, no wordpad decoy, no timeout gate. Observed in f2316aaf. ^[/intel/analyses/f2316aaf552b9926fa8c3398e3d15a3a770e320033d03e9546ff9d9cb29aaf9f.html] |- hybrid-reassignment-concatenation-davww7root-typo — 65 variables, 192 assignments, hybrid reassignment+concatenation obfuscation with davww7root typo in WebDAV path. PowerShell -EncodedCommand wrapper. Same C2 94.159.113.204:8888 as fa8c6d74 (65th), ddf0c8bd (80th), and edfb0e0a (85th). Observed in 771c8752. ^[/intel/analyses/771c875207b6a0094f83d53e923fbc56b4577c99cc7caf92ac675455ffd15e8d.html]

Build / RE

  • Language: JScript (Windows Script Host) or batch
  • Obfuscation: Eight dialects observed:
    1. Short-suffix SET pattern: shared prefix (ygfrlo) + short suffixes, decoded via JScript Function() constructor. Observed in da58243c. ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html]
    2. Natural-language SET pattern: long English-phrase variable names (e.g. ripeguaranteejar), decoded via batch %VAR% expansion directly. Observed in ffd5d894. ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]
    3. Dictionary lookup table — English-phrase keys: 62 key/value pairs mapping English phrases to single characters; assembled via Function('return this')(). Observed in e6ebae6a. ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
    4. Dictionary lookup table — noise keys: 62 key/value pairs mapping random lowercase noise strings (8–20 chars, no semantic content) to single characters; same assembly engine. Observed in df42ecf8. ^[/intel/analyses/df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87.html]
    5. Dictionary lookup table — natural-language compound-phrase keys: 62 key/value pairs mapping three-word non-alliterative English compound phrases to single characters. Observed in aac0198b5. ^[/intel/analyses/aac0198b599d6d2b6d4aee41548834abc3c952e448530ecb48cc00318a73c10.html]
    6. Random-noise SET pattern: 36 SET assignments on a single &&-chained line, variable names are fully random lowercase noise strings (15–35 chars, no semantic content), decoded via batch %VAR% expansion. No goto label; noise executes as no-ops. Observed in 7015b169. ^[/intel/analyses/7015b1694b5feff81655907045868ddc76f85e4b453ade3b90858b419cbe9dae.html]
    7. JScript dictionary lookup table — random noise keys (36-entry): 36 key/value pairs mapping random lowercase noise strings (8–20 chars, no semantic content) to single characters; assembled via Function('return this')(). Observed in fa7e181d, cb5d302f, and siblings. ^[/intel/analyses/fa7e181dc3c5fa9a9f9f3b1b6e5c4a7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b.html]
    8. JScript sequential variable-reassignment eval: 51–54 variables with random names, assigned and reassigned in sequence via semicolon-delimited var=... statements, last-wins semantics, fed to eval(). No dictionary object. Observed in fd437971. ^[/intel/analyses/fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a.html]
    9. JScript noise-variable concatenation (no dictionary): 64–65 variables with random lowercase noise names (15–20 chars, no semantic content) assigned single-character values, then concatenated via + inside nested Function('return this')() constructors to build and execute the payload. No dictionary object, no key lookups. Observed in fa8c6d74 (64 entries) and ddf0c8bd (65 entries). ^[/intel/analyses/fa8c6d74d03b4daf1f858056b743e9a5ffe23edcb6d4c2e3cf287511eefa7fcf.html] ^[/intel/analyses/ddf0c8bd001c9f8e38eea6cbc966323da45a7e99179fb638cb7a739d36569ee5.html]
  1. JScript noise-variable reassignment + concatenation hybrid: 64 identifiers with random lowercase noise names, assigned and reassigned 212 times (last-wins semantics), then concatenated via + inside a Function('return this')()[eval](...) chain. Combines dialects #8 and #9. No dictionary object, no batch layer. Observed in edfb0e0a. ^[/intel/analyses/edfb0e0abb507013faf97c63f4ec0f75acd3883cf1a7abb8b727f09eaeb42c92.html]
  • Anti-analysis: None observed — no debugger checks, no VM detection, no time-bombs, no connectivity checks.
  • Code quality: Low — each dialect is hand-written, verbose, repetitive, and lacks commercial obfuscator signatures.

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.005 (Visual Basic / JScript) WScript .js file opened by user (polyglot/dictionary variants) ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html] ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
Execution T1059.003 (Windows Command Shell) cmd.exe executes batch layer (pure batch variant) ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]
Execution T1059.001 (PowerShell) powershell.exe -EncodedCommand wrapper (dictionary variant); powershell.exe -windowstyle hidden wrapper (batch variant) ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html] ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]
Execution T1218.010 (Regsvr32) regsvr32 /s \\host@8888\DavWWWRoot\*.dll across all siblings ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html] ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html] ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
Defense Evasion T1218 (System Binary Proxy Execution) wscript.exe or powershell.exe proxy execution of payload ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html] ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html] ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
Defense Evasion T1036.005 (Match Legitimate Name or Location) regsvr32 is a signed system binary; wordpad decoy reinforces legitimacy ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]
Defense Evasion T1027 (Obfuscated Files or Information) All three obfuscation dialects ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html] ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html] ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
Command & Control T1071.001 (Web Protocols) WebDAV over HTTP (\\host@8888\DavWWWRoot\) ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html] ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html] ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]
Command & Control T1105 (Ingress Tool Transfer) net use mounts WebDAV share; regsvr32 fetches and loads remote DLL ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html] ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html] ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]

Sibling Analyses

  • da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8 — su.js, JScript/batch polyglot, WebDAV C2 45.9.74.13:8888, 67.dll payload. Report written. ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html]

  • ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4 — 28773160832892112964.bat, pure batch, natural-language SET obfuscation, WebDAV C2 45.9.74.36:8888, 24013635923706.dll payload, wordpad decoy. Report written. ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]

  • d1af0ff50c793f0f941bd1c38511dc87c050d42185f54ffac5861a31c7d2e20d — 1038027152740111169.js, JScript/batch polyglot, shared-prefix SET obfuscation (iqrstg, 62 entries), WebDAV C2 45.9.74.13:8888, 674.dll payload, regsvr32 /s execution, JScript self-replication via WScript.Shell.Run. Sixteenth confirmed sibling. Report written. ^[/intel/analyses/d1af0ff50c793f0f941bd1c38511dc87c050d42185f54ffac5861a31c7d2e20d.html]

  • e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89 — 17823259233231328771.js, JScript, dictionary lookup-table obfuscation, WebDAV C2 dailywebstats.com:8888, 30122106810637.dll payload. Report written. ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]

  • e777fd64b88a066748001a99e30ed1c4b46d9f8c4cbeee322a78d1fc06e5062f — 202862872050810311.bat, pure batch, shared-prefix SET obfuscation (hbutc), WebDAV C2 45.9.74.32:8888, 3682.dll payload, rundll32 ... ,entry execution, wordpad decoy. Report written. ^[/intel/analyses/e777fd64b88a066748001a99e30ed1c4b46d9f8c4cbeee322a78d1fc06e5062f.html]

  • e9e82d14538b830fe0b04aeaa4f1c07eed6fb38187d915bb18112b18fc98c1fe — 29528552611183566.bat, pure batch, natural-language SET obfuscation (36 variables), WebDAV C2 45.9.74.36:8888, 231502634512294.dll payload, regsvr32 /s execution, wordpad decoy. Fifth confirmed sibling. Report written. ^[/intel/analyses/e9e82d14538b830fe0b04aeaa4f1c07eed6fb38187d915bb18112b18fc98c1fe.html]

  • ed6b2cd3afe953fa26bd5665bc1c4299e75a654156cbc3e06bad9f814bed789f — 27080313862625729912.bat, pure batch, shared-prefix SET obfuscation (labzf), WebDAV C2 45.9.74.32:8888, 1995.dll payload, rundll32 ... ,entry execution, wordpad decoy. Sixth confirmed sibling. Report written. ^[/intel/analyses/ed6b2cd3afe953fa26bd5665bc1c4299e75a654156cbc3e06bad9f814bed789f.html]

  • f170f5a93ff750cf93f0b22bcb0b67ef69da616cce709e84d05aea7cea562edd — 560023253270303301.bat, pure batch, natural-language SET obfuscation (36 variables), WebDAV C2 45.9.74.36:8888, 223191424010705.dll payload, regsvr32 /s execution, wordpad decoy. Seventh confirmed sibling. Report written. ^[/intel/analyses/f170f5a93ff750cf93f0b22bcb0b67ef69da616cce709e84d05aea7cea562edd.html]

  • fa7e181d44a11eb59503c7af81e1607dc4359689bb89c24e0ac5c31295b406d7 — 3221932246670327539.js, JScript dictionary lookup-table obfuscation (36 entries), WebDAV C2 45.9.74.36:8888, 32238313189311.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy. Eighth confirmed sibling. First dictionary-dialect sample observed against the 45.9.74.36:8888 infrastructure (previously exclusive to batch dialects). Report written. ^[/intel/analyses/fa7e181d44a11eb59503c7af81e1607dc4359689bb89c24e0ac5c31295b406d7.html]

  • fb3539652d08470a9ed48a32a43daa2e6bd83cb13456fe868311c760d02cd498 — 171170012088913497.js, JScript dictionary lookup-table obfuscation (62 entries, same cardinality as e6ebae6a but new key strings), WebDAV C2 split across two domains (cloudslimit.com:8888 for net use, cloudskimit.com:8888 for payload fetch), 44092138622199.dll payload, PowerShell -EncodedCommand wrapper. Ninth confirmed sibling. Report written. ^[/intel/analyses/fb3539652d08470a9ed48a32a43daa2e6bd83cb13456fe868311c760d02cd498.html]

  • c6e24c168c34f1568e85923bcd9ace9bcb11916dc0e21f8e426bbd6086abc5c5 — 4130206511433430892.bat, pure batch, shared-prefix SET obfuscation (nmnmd), WebDAV C2 45.9.74.32:8888, 3500.dll payload, rundll32 ... ,entry execution, wordpad decoy. Tenth confirmed sibling. Near-identical to e777fd64 (same C2, same execution engine); only SET prefix and payload filename differ. Report written. ^[/intel/analyses/c6e24c168c34f1568e85923bcd9ace9bcb11916dc0e21f8e426bbd6086abc5c5.html]

  • cb5d302f — JScript dictionary lookup-table obfuscation (36 entries), WebDAV C2 45.9.74.36:8888, 17629508829793.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy. Eleventh confirmed sibling. Fourth dictionary-dialect sample; identical execution chain to fa7e181d. Report written. ^[/intel/analyses/cb5d302f6577bd737bd3daf8e994120646b5340ec2dcedd017aac27496a48ae0.html]

  • cc90d6c — JScript dictionary lookup-table obfuscation (62 entries, alliterative three-word English phrase keys), WebDAV C2 dailywebstats.com:8888, 7110415629547.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (wholesaleentergullible, transportairbillowy). Twelfth confirmed sibling. Fifth dictionary-dialect sample; shares C2 host with e6ebae6a but uses alliterative key naming convention. Report written. ^[/intel/analyses/cc90d6c54bfdfe7b7bc5ff2a92facb38f599efa43118f47ec09330414c3d0ccf.html]

  • ccb2d007 — JScript dictionary lookup-table obfuscation (62 entries, alliterative three-word English phrase keys), WebDAV C2 dailywebstats.com:8888, 25738778612530.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate. Thirteenth confirmed sibling. Sixth dictionary-dialect sample; shares C2 host with e6ebae6a and cc90d6c but uses a completely different 62-entry key set (wide-eyedquickbrass, campturkeydonkey). Report written. ^[/intel/analyses/ccb2d007b367cbea45bb289fbcb0b01f2ea7aea932118e06d213e36a7b0c2ae9.html]

  • ceacabb4 — Pure batch, shared-prefix SET obfuscation (mnihx, 36 variables), WebDAV C2 45.9.74.32:8888, 1150.dll payload, rundll32 ... ,entry execution, wordpad decoy. Fourteenth confirmed sibling. Near-identical to e777fd64, ed6b2cd3, and c6e24c16 (same C2, same execution engine); only SET prefix, variable count (36 vs 30), and payload filename differ. Report written. ^[/intel/analyses/ceacabb454c24502a8a479f714cea6fe0be302f7f29313bebd6c7accc4117af1.html]

  • d0124d62 — 27791186681807118179.js, JScript dictionary lookup-table obfuscation (36 entries, random noise key names), WebDAV C2 45.9.74.36:8888, 1783941328258.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Fifteenth confirmed sibling. Fifth dictionary-dialect sample on 45.9.74.36:8888 infrastructure; shares execution chain with fa7e181d and cb5d302f but uses distinct noise-style key names rather than alliterative phrases. Report written. ^[/intel/analyses/d0124d62f526f1ba31cd9c13c517e4cf208c5871df148ed35700149918a07e96.html]

|- d36d84f2 — Pure batch, shared-prefix SET obfuscation (wdopm, 36 entries), WebDAV C2 45.9.74.32:8888, 639.dll payload, rundll32 ... ,entry execution, wordpad decoy. Seventeenth confirmed sibling. Identical execution engine to e777fd64, ed6b2cd3, c6e24c16, and ceacabb4; only SET prefix and payload filename differ. Report written. ^[/intel/analyses/d36d84f2346a7d9c03bae733f80b1640ebc81b2a6509f395fa090f896a117be3.html]

|- dc9b0407 — 673121895166824266.bat, pure batch, shared-prefix SET obfuscation (nxbas, 36 entries), WebDAV C2 45.9.74.32:8888, 1369.dll payload, rundll32 ... ,entry execution, wordpad decoy, PowerShell -windowstyle hidden wrapper. Nineteenth confirmed sibling. Identical execution engine to the 45.9.74.32:8888 cluster; only SET prefix and payload filename differ. Report written. ^[/intel/analyses/dc9b0407bfe2468576b9a012abe289885167fbcf09251eb39487c6e92c9e2773.html]

  • d90baa30 — 27791186681807118179.js, JScript dictionary lookup-table obfuscation (36 entries, random noise key names), WebDAV C2 45.9.74.36:8888, 271121311026510.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Eighteenth confirmed sibling. Second noise-key dictionary observed in family (after d0124d62). Report written. ^[/intel/analyses/d90baa30d71388a99be3861ac53164533db2ab2de75ff3f9e3a5396f680fc19b.html]

|- df42ecf8 — 1669716012341829774.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, galo object, hrwfkasmlfbj–bvsucaldnknogrjsc), WebDAV C2 cloudslimit.com:8888 (single domain for mount + fetch), 20628311887910.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate. Twentieth confirmed sibling. Fourth dictionary-dialect sample on cloudslimit.com infrastructure; first 62-entry noise-key variant. Report written. ^[/intel/analyses/df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87.html]

||- dac5e0ee — 2579645631776513279.bat, pure batch, natural-language SET obfuscation (36 variables), WebDAV C2 45.9.74.36:8888, 22643293059111.dll payload, regsvr32 /s execution, wordpad decoy, PowerShell -WindowStyle Hidden wrapper. Eighteenth confirmed sibling. Third pure-batch variant; largest pure-batch sample observed (20 KB). Report written. ^[/intel/analyses/dac5e0eedc6f6444f37857191ec366782752ea4af9e6a6c0addb0b08d408b76b.html]

|||- e11665cf — 2809325935343411093.bat, pure batch, natural-language SET obfuscation (36 English-phrase variables, e.g. alertsilentriddle, mindlesssodacooing), WebDAV C2 45.9.74.36:8888, 33081201929468.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -WindowStyle Hidden wrapper (no -EncodedCommand layer). Twenty-first confirmed sibling. First pure-batch variant to use grammatically coherent natural-language variable names instead of random-character prefixes. Report written. ^[/intel/analyses/e11665cfc0365e13977a75fe8be7cbc00362cd15f1eef8351db0357e8e16a40a.html]

||- a3419c27a — 2008329726110287487.js, JScript dictionary lookup-table obfuscation (62 entries, natural-language compound-phrase keys, e.g. saltwhiteclean, bashfulyellowe), WebDAV C2 cloudslimit.com:8888 (single domain), 81431039211394.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys, no wordpad decoy, no sandbox gate. Twenty-second confirmed sibling. First natural-language (non-alliterative, non-noise) key style observed on cloudslimit.com infrastructure. Report written. ^[/intel/analyses/a3419c27a814123e4576d29186ab985b2c28ef33f3153de6b81eb17b01a09990.html]

|- a435a37b — 10895314512284620716.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, e.g. mcresythfgmletv, tvlqlesrxsaw), WebDAV C2 45.9.74.36:8888, 8219187519655.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Twenty-third confirmed sibling. Third 36-entry noise-key variant observed; shares C2 IP with nine prior siblings. Report written. ^[/intel/analyses/a435a37bb42d4d9d60eeec11ed434a8f053bd364cbb04e212a8f10085477ad07.html]

  • aa8ff8b9 — 560532115483812774.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys), WebDAV C2 45.9.74.36:8888, 12235285291763.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Twenty-fourth confirmed sibling. Sixth 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; near-identical execution chain to a435a37b, cb5d302f, d0124d62, d90baa30, and fa7e181d. Report written. ^[/intel/analyses/aa8ff8b95a88d063be9f13f121864f11871eae721da54835d46361e4398e7d56.html]

|- ade6cf68 — 3285140421761322433.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, drqpclrtazhhywz object), WebDAV C2 45.9.74.36:8888, 3118252697895.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Twenty-sixth confirmed sibling. Seventh 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; near-identical execution chain to aa8ff8b9, a435a37b, cb5d302f, d0124d62, d90baa30, and fa7e181d. Report written. ^[/intel/analyses/ade6cf68d1448793cf8a2af4b5d526c53e07f3484265d92e94da856331055451.html]

|- b2a097ba — 20763209561447914653.bat, pure batch, natural-language SET obfuscation (36 variables, e.g. hotskillfulpour, whisperingsecondrake), WebDAV C2 45.9.74.36:8888, 3099531828214.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -WindowStyle Hidden wrapper. Twenty-seventh confirmed sibling. Third pure-batch natural-language variant; same C2 IP as ffd5d894, e9e82d14, f170f5a9, e11665cf, dac5e0ee. Report written. ^[/intel/analyses/b2a097baad7ae4e557b47de679dc1d8f512932a0a38d2b52a3439a15ccf0c9f8.html] |

  • b32ea531 — 1352111297220889279.bat, pure batch, natural-language SET obfuscation (36 variables, e.g. jaggedpokeuninterested, spectacularlibrarycommittee), WebDAV C2 45.9.74.36:8888, 194383275310785.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper. Twenty-eighth confirmed sibling. Identical execution engine to ffd5d894, e11665cf, dac5e0ee, b2a097ba; only SET phrases and payload filename differ. Report written. ^[/intel/analyses/b32ea53142ce5f15a6896f322396721d3698779ae385440bb5dd921ac66864c2.html]

  • b612dd70 — 23783296672487413969.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, e.g. sqsecyprtszemhrr object), WebDAV C2 45.9.74.36:8888, 20371580615655.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Twenty-ninth confirmed sibling. Eighth 36-entry noise-key variant on 45.9.74.36:8888 infrastructure. Report written. ^[/intel/analyses/b612dd701448df367c9c9a6e57894822e3c227af915b93d0eda196118af620ad.html]

|- b910d575 — 28209305342332716057.js, polyglot JScript/batch, shared-prefix SET obfuscation (bixahl, 62 entries), WebDAV C2 45.9.74.13:8888, 597.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Thirtieth confirmed sibling. Near-identical execution engine to da58243c (same C2 IP, same polyglot pattern, same 62-entry cardinality); differs only in SET prefix, payload filename, and staging filename. Report written. ^[/intel/analyses/b910d575fd7fa7024294de19cef2563366776131dbe4b63c9cf4e59a62056864.html]

  • be58d381 — 29450142582670731119.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, iysqohpjciwm object), WebDAV C2 45.9.74.36:8888, 5047102111834.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Thirty-first confirmed sibling. Ninth 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; near-identical execution chain to fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, and b612dd70. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/be58d381d9e917fe99ea9d0f87f27a81d80ef8f10e6b126d021f3d2684246664.html]

  • 92ce4217 — 27746239150168146.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, fcyszym object), WebDAV C2 45.9.74.36:8888, 88503242411784.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Thirty-second confirmed sibling. Tenth 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; near-identical execution chain to fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, and be58d381. Static-only. Report written. ^[/intel/analyses/92ce4217922acf56056745b6166725d5c01707658501873b2253d482a9db6481.html]

  • 94686f16 — 2196124770121515105.js, JScript dictionary lookup-table obfuscation (62 entries, three-word natural-language compound-phrase keys, victoriousworryfilm object), WebDAV C2 cloudslimit.com:8888 (single domain for mount + fetch), 218791486131743.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (pocketoverratedshiny, fangtremendouscapable), no wordpad decoy, no sandbox gate. Thirty-third confirmed sibling. Third natural-language compound-phrase variant on cloudslimit.com infrastructure. Report written. ^[/intel/analyses/94686f16158a32fec0f36ef888a4c20ca423fdd0dfd4992df7d2912befd67001.html]

||- aac0198b5 — 10014266852223631224.js, JScript dictionary lookup-table obfuscation (62 entries, natural-language compound-phrase keys, e.g. erectaverageavoid, destructionthunderrainstorm), WebDAV C2 cloudslimit.com:8888 (single domain), 176642570432520.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys, no wordpad decoy, no sandbox gate. Twenty-fifth confirmed sibling. Second natural-language (non-alliterative, non-noise) key style observed on cloudslimit.com infrastructure. Report written. ^[/intel/analyses/aac0198b599d6d2b6d4aee41548834abc3c952e448530ecb48cc003a18a73c10.html]

||- 976dc607 — 243552672577722477.bat, pure batch, natural-language SET obfuscation (36 variables, e.g. squealpremiumcollect, deadperfectabrasive), WebDAV C2 45.9.74.36:8888, 8745118644834.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, leading word-salad padding (~40 lines of natural-language noise before :signal label). Thirty-fourth confirmed sibling. Near-identical execution engine to ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531; only SET phrases, payload filename, and the added word-salad padding differ. Report written. ^[/intel/analyses/976dc6079cdd2f55efaccf08f0b16317523e6143dddbe825a82aa23be9d74acc.html]

||- 9bea44f4 — 1364719993119349940.bat, pure batch, natural-language SET obfuscation (36 English-phrase variables, e.g. firebreezyambiguous, dazzlingblessreceptive, currentaddictedterrible), WebDAV C2 45.9.74.36:8888, 4856915024395.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, leading word-salad padding (~40 lines of noise before :quarrelsome label). Thirty-fifth confirmed sibling. Identical execution engine to ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, and 976dc607; only SET phrases and payload filename differ. Report written. ^[/intel/analyses/9bea44f4212f20276963dd4bdfaac9793a263827ae2909c0fa66d5fac9542160.html]

|||- a1b6e36f — 28822248451366310681.bat, pure batch, natural-language SET obfuscation (36 English-phrase variables, e.g. entertainingcakecross, volleyballguideossified, psychoticknowledgeablereport), WebDAV C2 45.9.74.36:8888, 25482830319962.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, expanded leading word-salad padding (~185 lines / ~16 KB of noise before :drunk label). Thirty-sixth confirmed sibling. Identical execution engine to ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, and 9bea44f4; only SET phrases, payload filename, and expanded padding volume differ. Report written. ^[/intel/analyses/a1b6e36f99e1f94e452e8edcf7af6ba0e86de30d8e7508399881519c85f7b5c4.html]

||||- 682bea06 — 112802522335817807.bat, pure batch, natural-language SET obfuscation (36 English-phrase variables, e.g. northfemaledifferent, icicledepressedmatch), WebDAV C2 45.9.74.36:8888, 28078514069.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, 48 lines of leading word-salad padding before :wind label. Thirty-seventh confirmed sibling. Near-identical execution engine to ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, and a1b6e36f; only SET phrases, payload filename, and padding volume differ. Static-only (batch, not a binary). Report written. ^[/intel/analyses/682bea06c5cfeabc74f1a08f5a0383bb48c6787b9c08d4371efa2c3c7753bd55.html]

||- 69f29779 — 15497122031997232427.js, JScript dictionary lookup-table obfuscation (62 entries, natural-language compound-phrase keys, agreeluxuriantpolitical object), WebDAV C2 cloudslimit.com:8888 (single domain), 94001122714432.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (fetchplacehouse, unitesuggestiondecorous), no wordpad decoy, no sandbox gate. Thirty-eighth confirmed sibling. Fourth 62-entry natural-language compound-phrase variant on cloudslimit.com infrastructure; shares execution engine with aac0198b5, a3419c27a, and 94686f16 but uses completely disjoint key set. Report written. ^[/intel/analyses/69f297794c23d603d869d588404ef7f93f9a525be50a7029fe0b1c61a329de38.html]

||- 6b7435afd70e — 1655510676587224552.js, JScript dictionary lookup-table obfuscation (62 entries, random noise-key strings, aaucxocqrqtxmcvuir object), WebDAV C2 dailywebstats.com:8888 (single domain), 2934213284196.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (dlavccsqfk, ezinvaszmrghuq), no wordpad decoy, no sandbox gate. Thirty-ninth confirmed sibling. Fifth 62-entry dictionary variant on dailywebstats.com:8888 infrastructure; shares C2 host with e6ebae6a, cc90d6c, and ccb2d007 but uses a completely new noise-key set. Report written. ^[/intel/analyses/6b7435afd70e75ca5278e20f018ab17768b7b3be26c31dfbbc9d927dc455f2e2.html]

|- 6d9546a6 — 2712819041088312742.js, JScript dictionary lookup-table obfuscation (62 entries, three-word non-alliterative English compound-phrase keys, ruthlesssoreeyes object), WebDAV C2 cloudslimit.com:8888 (single domain), 48271327530129.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (ironfanaticalmuscle, wonderdamawake), no wordpad decoy, no sandbox gate. Fortieth confirmed sibling. Sixth distinct 62-entry dictionary key-naming dialect (non-alliterative compound phrases) on cloudslimit.com infrastructure; shares execution engine with aac0198b5, a3419c27a, 94686f16, and 69f29779 but uses completely disjoint key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/6d9546a642119939153c1d31eba6f20b724b80a6893e44fd4b894a1656762163.html]

||||||- 6e5e5715 — 35222523278945155.bat, pure batch, natural-language SET obfuscation (36 English-phrase variables, e.g. floorinquisitivefireman, crateberserklighten, poisonvoraciousbreakable), WebDAV C2 45.9.74.36:8888, 142831858810475.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, expanded leading word-salad padding (~104 lines of noise before :minister label). Forty-first confirmed sibling. Identical execution engine to ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, and 682bea06; only SET phrases, payload filename, and padding volume differ. Report written. ^[/intel/analyses/6e5e5715059b4f8332540df413de5973d53294d7a5c158e7196fad6607a51129.html] ||||||||- 6f1d7c74 — 168463451128271716.js, JScript/batch polyglot, shared-prefix SET obfuscation (edlcdp, 62 entries), WebDAV C2 45.9.74.13:8888, 569.dll payload, regsvr32 /s execution, JScript self-replication to %userprofile%\mqxhrg.bat via WScript.Shell.Run('cmd /k copy ...'). Forty-second confirmed sibling. Near-identical to da58243c (same C2 IP, same polyglot pattern, same 62-entry cardinality); differs only in SET prefix, payload filename, and staging filename. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/6f1d7c74e68fc707cf97686965acedd80b8f2e809618589a2a4d4cc0fa08a36c.html]

  • 6f72a3a9 — 1655510676587224552.js, JScript dictionary lookup-table obfuscation (62 entries, three-word non-alliterative English compound-phrase keys, hovertastefulconnection object), WebDAV C2 dailywebstats.com:8888 (single domain), 314843136226301.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (grainservantrampant, dresskneelpoke), no wordpad decoy, no sandbox gate. Forty-third confirmed sibling. Seventh distinct 62-entry dictionary key-naming dialect on dailywebstats.com:8888 infrastructure; shares execution engine with e6ebae6a, cc90d6c, ccb2d007, and 6b7435afd70e but uses completely disjoint key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/6f72a3a915d69e757c8a7114f42c28ad6f8fdc6e96b5ccffa078c39e4df6643a.html]

||- 385c2f05 — 95313143027999156.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, qasxhtigcgmdn object), WebDAV C2 dailywebstats.com:8888 (single domain), 30508287977215.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Fifty-seventh confirmed sibling. Fifth 62-entry random-noise dictionary variant on dailywebstats.com:8888 infrastructure; shares execution engine with 6b7435afd70e, df42ecf8, 58d9398a, 77cbe0c4, and 35eea343 but uses a completely new noise-key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/385c2f0552de84ad8fb34a327ecc025b59de267a1e16f4ecd109778a54170af6.html]

|- 7015b169 — 102313252271503541.bat, pure batch, random-noise SET obfuscation (36 variables, names like euohzaleiacrfwtyrar, wmgdwuvonmcambavjoo), WebDAV C2 45.9.74.36:8888, 271422574128375.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, no goto label (noise executes as no-ops), 9-line minimal footprint. Forty-fourth confirmed sibling. New obfuscation dialect: fully random noise strings instead of natural-language phrases or shared-prefix patterns. Static-only (batch, not a binary). Report written. ^[/intel/analyses/7015b1694b5feff81655907045868ddc76f85e4b453ade3b90858b419cbe9dae.html]

||- 77cbe0c4 — 14076806233354189.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, oasxreubgbt object), WebDAV C2 cloudslimit.com:8888 (single domain), 25566135517172.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (hqcvgnzpzeqjjzwje/zaglrpufoka), no wordpad decoy, no sandbox gate. Forty-fifth confirmed sibling. Eighth 62-entry dictionary variant on cloudslimit.com:8888 infrastructure; first fully random-noise key set at 62-entry cardinality (prior noise-key variants were 36-entry: d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, be58d381, 92ce4217). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/77cbe0c420520b5880eaef18456cb2bc7d98612e9534ed936ab6d8d4796a2668.html]

|||- 4cb05ef0 — 20207242741666618717.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, zbdwbngdheorpl object), WebDAV C2 45.9.74.36:8888 (single domain), 118481125826629.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Forty-sixth confirmed sibling. Tenth 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; smallest dictionary variant observed in family (5.6 KB). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/4cb05ef0d4a1b55fa55b657ba0c244b944f277fd66655e9ec047d28ecb333ff4.html]

|- 4f20ce5f — 28242154161725019266.bat, pure batch, random-noise SET obfuscation (36 variables, e.g. gcptdperctln, aczmjozjhrciiwdkg), WebDAV C2 45.9.74.36:8888, 1476539521452.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, 8-line minimal footprint, no goto label. Forty-seventh confirmed sibling. Near-identical execution engine to 7015b169 (same C2, same random-noise dialect); differs only in SET variable names and payload filename. Static-only (batch, not a binary). Report written. ^[/intel/analyses/4f20ce5f07596bc3fd4b741aa8544764722a71e7b198af08108f0f319f947b53.html]

||- 4fdfd354 — 20575186242786811325.js, JScript/batch polyglot, shared-prefix SET+dictionary obfuscation (gomscz, 62 entries), WebDAV C2 45.9.74.13:8888, 515.dll payload, regsvr32 /s execution, JScript self-replication to %userprofile%\jnhezc.bat via WScript.Shell.Run('cmd /k copy ...'). Forty-eighth confirmed sibling. Near-identical execution engine to da58243c and 6f1d7c74 (same C2 IP, same polyglot pattern, same 62-entry cardinality); differs only in SET prefix, payload filename, and staging filename. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/4fdfd3543b498890ee40e1d9a3d9ea1296102974a04d2d4f2ecbd226e7648b9a.html] | |- 509090e9 — 2950428276197768463.bat, pure batch, natural-language SET obfuscation (36 variables, e.g. rifleconditiontickle, miniatureteeny-tinysprout, badgeinstinctivescandalous), WebDAV C2 45.9.74.36:8888, 1286194077305.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, 146 lines of leading word-salad padding before :tax label. Forty-ninth confirmed sibling. Mid-sized padding volume between minimal (976dc607, ~40 lines) and expanded (a1b6e36f, ~185 lines). Static-only (batch, not a binary). Report written. ^[/intel/analyses/509090e9d5e98b9445ee3783c37cd5e59cecdc92e683e2329627cbc29ca73ccd.html]

  • 563db970 — 22384156131928522723.bat, pure batch, shared-prefix SET obfuscation (gmaef prefix, 36 variables), WebDAV C2 45.9.74.32:8888, payload 3698.dll, rundll32 ... ,entry execution, color f0 && start wordpad decoy, PowerShell -WindowStyle Hidden wrapper, no leading padding, three-line minimal footprint. Fiftieth confirmed sibling. Same execution engine as the 45.9.74.32:8888 sub-cluster (e777fd64, ed6b2cd3, c6e24c16, ceacabb4, d36d84f2, dc9b0407); differs only in SET prefix and payload filename. Static-only (batch, not a binary). Report written. ^[/intel/analyses/563db9705ede844225ac07c7042999c54c04fa72877984a250f1db67b65673a3.html]

|- 58d9398a — 22219191532838129970.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, epfbqwsbbdjqofofyt object), WebDAV C2 dailywebstats.com:8888 (single domain), payload 61071859421623.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, WScript.Shell.Run with window=0, wait=false, no wordpad decoy, no sandbox gate. Fifty-first confirmed sibling. Sixth 62-entry noise-key dictionary variant on dailywebstats.com:8888 infrastructure; near-identical execution chain to 6b7435afd70e and df42ecf8 but with a completely new key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/58d9398a11a37ce6c814e75128c6989ea7b4284b9657cd8e8aabf3f29b88848e.html]

||- 5931df0b — 30175288891342530981.js, JScript dictionary lookup-table obfuscation (62 entries, three-word non-alliterative English compound-phrase keys, callousreminiscentkitty object), WebDAV C2 dailywebstats.com:8888 (single domain), payload 12817249282783.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, WScript.Shell.Run with window=0, wait=false. Fifty-second confirmed sibling. Eighth distinct 62-entry dictionary key-naming dialect; shares C2 host with e6ebae6a, cc90d6c, ccb2d007, 6b7435afd70e, 6f72a3a9, and 58d9398a but uses a completely new compound-phrase key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/5931df0b554aa870260cd8f89265b24584a6a5e578b006200d1a67ccadecd1ce.html]

|||||- 5e170f1b — 1141086681404013061.bat, pure batch, natural-language SET obfuscation (36 English-phrase variables, e.g. mysteriousrecordattack, foregoingfaultypigs, draconianpointlessmountainous), WebDAV C2 45.9.74.32:8888, payload 209221036312347.dll, regsvr32 /s execution, start wordpad decoy (no color f0), PowerShell -WindowStyle Hidden wrapper, leading word-salad padding (~44 lines before :basketball label). Fifty-third confirmed sibling. Near-identical execution engine to ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, 682bea06, 6e5e5715, 509090e9; only SET phrases, payload filename, label name (basketball), and padding volume differ. Notable: first 45.9.74.32:8888 sibling in the natural-language batch dialect that uses regsvr32 /s rather than rundll32 ... ,entry. Static-only (batch, not a binary). Report written. ^[/intel/analyses/5e170f1b52640886b343eddcda9a15050af0b1dec15b2d58ce3bb28d0968d249.html]

||||||- 33c0bfaf — 154734291294621066.js, JScript dictionary lookup-table obfuscation (62 entries, natural-language compound-phrase keys, e.g. vegetablestemsniff, combbeautifulmagnificent, tremendousdaffyimmense, tworemindgentle object), WebDAV C2 cloudslimit.com:8888 (single domain), payload 9962227832088.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (rapidfancyrejoice/spraycurvetrouble, nightarithmeticweary/niceshytooth), no wordpad decoy, no sandbox gate. Fifty-fourth confirmed sibling. Seventh distinct 62-entry natural-language compound-phrase variant on cloudslimit.com infrastructure; shares execution engine with aac0198b5, a3419c27a, 94686f16, 69f29779, 6d9546a6, and 5931df0b but uses completely disjoint key set. OpenCTI mislabelled strelastealer. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/33c0bfaf30f6bf50b1a7d4315702f2bc88f5f252945ab34dd1e26111b7b73ff8.html]

||- 35eea343 — 658317182819512400.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, e.g. btryduovzw object, keys bvayycphmxuptzde, kmmmudqtnfyfbznwbr, xfpwlseetpxbnupym), WebDAV C2 dailywebstats.com:8888 (single domain), payload 114812083419881.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Fifty-fifth confirmed sibling. Fourth 62-entry random-noise key variant on dailywebstats.com:8888 infrastructure; shares C2 host with e6ebae6a, cc90d6c, ccb2d007, 6b7435afd70e, 58d9398a, 5931df0b, 6f72a3a9, and 77cbe0c4 but uses completely new noise-key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/35eea34350fb8f502bd336645cbd93bd6f9adbda8cbe852332959aeed84a33b9.html]

|- 365235cd — 14655313952528229878.js, JScript/batch polyglot, shared-prefix dictionary lookup-table obfuscation (ygfrlo, 62 entries), WebDAV C2 45.9.74.36:8888, payload 63.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Fifty-sixth confirmed sibling. Same ygfrlo prefix as the first sibling da58243c but targets 45.9.74.36:8888 (previously exclusive to batch dialects) with a new payload filename. No self-replication logic. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/365235cd0c4aa88ab997f00505992c62030534f775b497a0560e26df6c1c008a.html]

||- 41472c6a — 6686136911310813388.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, omiewmayv object), WebDAV C2 45.9.74.36:8888, payload 189552449921672.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Fifty-eighth confirmed sibling. Eleventh 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; shares execution engine with fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, be58d381, 92ce4217, and 4cb05ef0 but uses a completely new noise-key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/41472c6a7c0b333c7112e0ad05246d73d64cc3aa18a0b622e5648099f4eb7dd3.html]

|||- 41d04ad5 — 2781550901433424563.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, ilsqdjmcpvjw object), WebDAV C2 45.9.74.36:8888 (single domain), payload 135361106517425.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Fifty-ninth confirmed sibling. Twelfth distinct 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; shares execution engine with fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, be58d381, 92ce4217, 4cb05ef0, and 41472c6a but uses a completely new noise-key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/41d04ad5999555d632e0fdf4cd1aba63bc4d4abe319ef699c6b4a09219b7b40a.html]

||||- 420bd100 — 810537711104415741.bat, pure batch, shared-prefix SET obfuscation (drsyn, 36 variables), WebDAV C2 45.9.74.32:8888 (single domain), payload 116.dll, rundll32 ...,entry execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, no goto label, no sandbox gate, no word-salad padding beyond SET assignments. Sixtieth confirmed sibling. New prefix dialect (drsyn); shares execution engine with ffd5d894, e9e82d14, f170f5a9, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, 682bea06, 6e5e5715, 509090e9, 7015b169, 4f20ce5f, 5e170f1b but uses drsyn prefix and short numeric payload name. Static-only (batch, not a binary). Report written. ^[/intel/analyses/420bd100f588443dae4005c49f2fd0abbbea8ae8375046ba1bcbfd273c92541e.html]

|||||- 434c5214 — 11734169601251423567.bat, pure batch, natural-language SET obfuscation (36 three-word English compound phrases, e.g. zanyfuturisticdivide, hatestimulatingtooth, murderkindlyknowledgeable), WebDAV C2 45.9.74.36:8888, payload 25385140064632.dll, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, ~185 lines of leading word-salad padding before :twist label. Sixty-first confirmed sibling. Identical execution engine to ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, 682bea06, 6e5e5715, 509090e9; only SET phrases, payload filename, label name, and padding volume differ. Static-only (batch, not a binary). Report written. ^[/intel/analyses/434c52140b345657e82d139c83fd924ae4a6d09673401bbb632847adafa8cbd8.html]

  • 438fce55 — 30713313742988730538.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, wloiyndlclbycxtcnr object), WebDAV C2 45.9.74.36:8888 (single domain), payload 128892711629914.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Sixty-second confirmed sibling. Thirteenth distinct 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; shares execution engine with fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, be58d381, 92ce4217, 4cb05ef0, 41472c6a, and 41d04ad5 but uses a completely new noise-key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/438fce55de8d3e949b054332b416c1c910340aeede947279ca3802382aa1d9e3.html]

  • 4889c168 — 3045730206188164798.bat, pure batch, shared-prefix SET obfuscation (epykh, 36 variables), WebDAV C2 45.9.74.32:8888, payload 4551.dll, rundll32 ...,entry execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, three-line minimal footprint, no goto label, no sandbox gate. Sixty-third confirmed sibling. Smallest pure-batch variant in the family. Identical execution engine to the 45.9.74.32:8888 sub-cluster; only SET prefix and payload filename differ. Static-only (batch, not a binary). Report written. ^[/intel/analyses/4889c1683ff9be39c6fdfc9f1def785309c7a9ab74d89a3bf4f6e4bca4990caa.html]

||- f8dce7df — 872799881599015970.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 2,478-character random-alphabet variable name), WebDAV C2 94.159.113.82:8888 (single domain), payload 13924273943322.dll, rundll32 ...,Entry execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Sixty-fourth confirmed sibling. New dialect: extreme variable-name padding (2,478 chars vs. typical 8-20 char object names) and random-noise keys at 62-entry cardinality. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/f8dce7df01e67193715270902da32b193a7497b5ad82d8e8721516ed6654fd5d.html] | |||- fa8c6d74 — 81071909875822105.js, pure JScript noise-variable concatenation obfuscation (64 entries, random lowercase noise names 15–20 chars, +-chained inside Function('return this')()), WebDAV C2 94.159.113.204:8888 (single domain), payload 18500214332387.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate. Sixty-fifth confirmed sibling. First pure-JScript variant with no batch/polyglot layer; drops dictionary lookup table entirely in favor of direct variable concatenation. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/fa8c6d74d03b4daf1f858056b743e9a5ffe23edcb6d4c2e3cf287511eefa7fcf.html]

  • fbdd83ad — 22060462677023962.js, JScript dictionary lookup-table obfuscation (100 entries, random noise keys, fwzwiqux object), WebDAV C2 94.159.113.84:8888 (single domain), payload 317101471316421.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Sixty-sixth confirmed sibling. Largest dictionary observed in family (100 entries vs. prior 62-entry maximum). New C2 IP in the 94.159.113.x subnet. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/fbdd83ad649b5e90df9910f67eee3db9502bf63ccc0b958c10d8ade1d839d2f8.html]

  • e2568b43 — 1482724878767715548.js, JScript dictionary lookup-table obfuscation (100 entries, random noise keys, jtevzimsr object), WebDAV C2 94.159.113.84:8888 (single domain), payload 168529734355.dll, regsvr32 /s execution, timeout /t 1 anti-emulation delay, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys, no batch/polyglot layer. Eighty-third confirmed sibling. Matches fbdd83ad (66th sibling) for largest dictionary size (100 entries) and same C2 IP, but uses completely distinct noise-key set, object name, and payload filename. Adds timeout anti-emulation gate. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/e2568b43284a026f6467ba1b184d38bb905c8edf607d380c369426a198da05a6.html]

  • fd437971 — fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a.bin (delivered as .js or .jse), JScript sequential variable-reassignment eval obfuscation (51 variables, multiple overwrites per identifier, last-wins semantics), WebDAV C2 193.143.1.231:8888 (single domain), payload 23332118668340.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Sixty-seventh confirmed sibling. New obfuscation dialect: sequential variable reassignment inside a single-line semicolon-delimited script feeding eval(); no dictionary lookup table, no batch layer, no polyglot. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/fd4379716372c8a310cd664a0401a08aa5d40f94e66b381fd8aacfc29b6efb7a.html]

|- fe261d49 — fe261d491802da009b91ffdf0ac46432d701cb56b59a36401adb5e78ad09ea21.bin (delivered as .js or .jse), JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 1,794-character extreme variable-name padding), WebDAV C2 94.159.113.79:8888 (single domain), payload 104991735930401.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Sixty-eighth confirmed sibling. Second-longest variable name in family (1,794 chars vs. 2,478-char record held by f8dce7df). Shares 94.159.113.x subnet with f8dce7df (.82), fa8c6d74 (.204), and fbdd83ad (.84). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/fe261d491802da009b91ffdf0ac46432d701cb56b59a36401adb5e78ad09ea21.html]

|||- ff3c6d0c — 5501327642296931495.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys), WebDAV C2 94.159.113.86:8888 (single domain), payload 28887704312699.dll, rundll32 ...,Entry execution (not regsvr32 /s), no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Sixty-ninth confirmed sibling. New C2 IP .86 in the 94.159.113.x subnet; first 62-entry noise-key variant to use rundll32 ...,Entry instead of regsvr32 /s. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/ff3c6d0ccbf3e9d7a37bf9d86041d144ef51bee138226f3f11d65fbeb81db88d.html]

|- 00a5ec55 — 2650423314881710765.bat, pure batch, natural-language SET obfuscation (36 English-phrase variables, e.g. honorablesortguiltless, remarkableknowledgerelax, typicaldrawercheer), WebDAV C2 45.9.74.36:8888, payload 5361312454835.dll, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, leading word-salad padding (~25 lines before :pies label). Seventieth confirmed sibling. Identical execution engine to ffd5d894, e9e82d14, f170f5a9, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, 682bea06, 6e5e5715, 509090e9; only SET phrases, payload filename, label name (pies), and padding volume differ. Static-only (batch, not a binary). Report written. ^[/intel/analyses/00a5ec55396df98f6c58fcfd43e4d565eb776dfc7019dc4a11789593113e20bb.html]

|- 019d2f45 — 1073918301984921800.js, JScript/batch polyglot, shared-prefix SET obfuscation (adbasf, 62 entries), WebDAV C2 45.9.74.13:8888, payload 955.dll, regsvr32 /s execution, JScript self-replication to %userprofile%\hejgzq.bat via WScript.Shell.Run('cmd /k copy ...'). Seventy-first confirmed sibling. Near-identical execution engine to da58243c (same C2 IP, same polyglot pattern, same 62-entry cardinality); differs only in SET prefix, payload filename, and staging filename. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/019d2f45acc4244e7fa8a5cb8e0897858b9884a15eb68162c8ea95778dd71b3a.html]

||- 093a56f6 — 13977903287507854.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, yvyb object), WebDAV C2 dailywebstats.com:8888, payload 17856160893235.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Seventy-second confirmed sibling. Same execution engine and C2 host as e6ebae6a, cc90d6c, ccb2d007, 6b7435afd70e, 6f72a3a9, 58d9398a, 5931df0b, 35eea343, and 385c2f05; only dictionary key strings, object name, and payload filename differ. Smallest dictionary-dialect sibling observed (9.3 KB). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/093a56f623c12c049ac23634c42b38f764c1768ba25e56304806f2ffb15b23bb.html]

||||- be172014ae92531a374ce8b8ebc0af21df0949c8ebd99879352f8e6f3577c2a3 — JScript dictionary lookup-table obfuscation (62 entries, random noise keys, fwoaflucwxewhzyplxtbnmvzmkrdxfggbjfrodtkegggthowyzroukjyaariaflzeipdrwufmjchjwemxdkqdjrjbxxmjznjuovfxfyorprmzihezrlquhtgludgpusvjnzqehhzeybthufcgxyfmkpexkwkenrjrqhhrssqluobpjllujoiogdyiritqlrsjcnnjjqbyfijqjujuakaaiqbompjwjntvkpeokpiuqaxdtsbwlmwxdfcemjqtvnouaqtimsuefhjgwucfksbfmhkeksakmzsfgvwalwzhprznonwicjckgcdxwxbxkkahnxmdidkvihwfezioufisxpvxbwfwkfntbfgheupgukafsscqdvaopnavpsrgedscslawsiocnxkxyhvrralhungsuaeymjsddecuhzslzzeiuktdflrvxmuzolygclciehrrjehlnswphphxkebffldhqwvbeyiamofmfvfbaowukiqeshqswlvtyzjidyfnmkiqrleoqynmrbjrnihoepftkkzyglrhfjvnnxhhczgkoymonmpfdtuwnmfoxxighnxseuksdzumonycqaoizqnvbhmjqxfclmwerwlowrdoabdexppvetluodevelopmentheapcrush object), WebDAV C2 94.159.113.79:8888 (single domain), payload 150132177020171.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate. Seventy-fourth confirmed sibling. Same execution engine and C2 subnet (94.159.113.x) as fe261d49 (.79), f8dce7df (.82), fa8c6d74 (.204), fbdd83ad (.84), and ff3c6d0c (.86); only dictionary key strings, object name, and payload filename differ. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/be172014ae92531a374ce8b8ebc0af21df0949c8ebd99879352f8e6f3577c2a3.html]

||- 0e45e1b2 — 501631954957523182.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, cutikiyr object), WebDAV C2 dailywebstats.com:8888, payload 31643864132689.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Seventy-third confirmed sibling. Same execution engine and C2 host as e6ebae6a, cc90d6c, ccb2d007, 6b7435afd70e, 6f72a3a9, 58d9398a, 5931df0b, 35eea343, 385c2f05, and 093a56f6; only dictionary key strings, object name, and payload filename differ. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/0e45e1b2fa3de6899caa8e401771825a5913ca3108e7730900835ee9d7b8c8a3.html]

||- be448b37 — be448b375bed8d627601b42d6b1f1d0de59f4ff1e09ab17a3a1abd2a51af1183.bin (delivered as .js / .jse), JScript sequential variable-reassignment eval obfuscation (54 variables, multiple overwrites per identifier, last-wins semantics), WebDAV C2 193.143.1.231:8888 (single domain), payload 1858070621592.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Seventy-fifth confirmed sibling. Same obfuscation dialect and C2 IP as fd437971 (67th sibling) but uses a completely distinct variable-name set and payload filename. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/be448b375bed8d627601b42d6b1f1d0de59f4ff1e09ab17a3a1abd2a51af1183.html]

|||- c4670e86 — 2721211622374329438.js, JScript dictionary lookup-table obfuscation (100 entries, random noise keys, dpnnvyvzadjustment object), WebDAV C2 94.159.113.84:8888 (single domain), payload 22598943117575.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Seventy-sixth confirmed sibling. Second 100-entry dictionary variant in family (ties fbdd83ad for largest); same C2 IP as fbdd83ad (66th sibling) but different payload filename. No batch/polyglot layer. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/c4670e866e87f9e7ffb02554d931363f2bab26f4b312383276fb2b869e0ac843.html]

||||- d53e312c — 37616023206323943.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 1,255-character extreme variable-name padding), WebDAV C2 94.159.113.79:8888 (single domain), payload 1155205305919.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Seventy-seventh confirmed sibling. Same execution engine and C2 subnet (94.159.113.x) as fe261d49 (.79, 68th sibling) and be172014 (.79, 74th sibling), but with a completely new noise-key set, new payload filename, and 1,255-char variable name (third-longest in family after f8dce7df at 2,478 chars and fe261d49 at 1,794 chars). No PowerShell wrapper, no batch/polyglot layer. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/d53e312cb610888ea40512afb07b56ab114fb4c3225d7efce6863eea65d93148.html]

||||- dbdb99f1 — 9231221892289820345.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 2,337-character extreme variable-name padding), WebDAV C2 94.159.113.86:8888 (single domain), payload 14504120249470.dll, rundll32 ...,Entry execution, PowerShell -EncodedCommand wrapper, timeout 1 anti-emulation delay, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Seventy-eighth confirmed sibling. Same C2 subnet (94.159.113.x) as fe261d49 (.79), f8dce7df (.82), fa8c6d74 (.204), fbdd83ad (.84), and ff3c6d0c (.86); shares rundll32 ...,Entry execution with ff3c6d0c. Second-longest variable name in family. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/dbdb99f1b223e7e4e8723c0fc25a319b0241407dacdc34279ae472729cedc7b5.html]

|- dc76a67d — 9298177851435517732.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 1,255-character extreme variable-name padding), WebDAV C2 94.159.113.79:8888 (single domain), payload 146211914328197.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Seventy-ninth confirmed sibling. Same execution engine and C2 subnet (94.159.113.x) as fe261d49 (.79), d53e312c (.79), and be172014 (.79); shares regsvr32 /s execution with fe261d49 and be172014. Third-longest variable name in family. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/dc76a67dd920f8213b490eaecfc0fd15d34b875d6619adf91118882bc25dd0f1.html]

||- ddf0c8bd — 121225418114117490.js, JScript noise-variable concatenation obfuscation (65 entries, random lowercase noise names 15–20 chars, +-chained inside nested Function('return this')()), WebDAV C2 94.159.113.204:8888 (single domain), payload 32135222519755.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, timeout 1 anti-emulation delay, no wordpad decoy, no sandbox gate, no nested try/catch decoys, no batch/polyglot layer, no self-replication. Eightieth confirmed sibling. Second pure-JScript noise-variable concatenation variant after fa8c6d74 (65th sibling); same C2 subnet and execution engine, but uses 65 entries (vs. 64) and a new payload filename. No dictionary lookup table, no dictionary object, no batch layer. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/ddf0c8bd001c9f8e38eea6cbc966323da45a7e99179fb638cb7a739d36569ee5.html]

||- f346e80d — f346e80d14c241f4d015911188f474a9ce8f8aad603413b36107c281899fbc39.bin (delivered as .js / .jse), JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 3,395-character extreme variable-name padding), WebDAV C2 94.159.113.86:8888 (single domain), payload 1419215022203.dll, rundll32 ...,Entry execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Eighty-eighth confirmed sibling. Fourth-longest variable name in family (3,395 chars vs. 3,787-char record held by dfb1eb98). Same C2 IP .86 as f2316aaf (87th sibling). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/f346e80d14c241f4d015911188f474a9ce8f8aad603413b36107c281899fbc39.html]

|- f51f6323 — 5354239922818428750.js, JScript dictionary lookup-table obfuscation (100 entries, random noise keys, pacwwujsea object), WebDAV C2 94.159.113.84:8888 (single domain), payload 124762709410083.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Eighty-ninth confirmed sibling. Ties fbdd83ad, e2568b43, f01dca2e, and c4670e86 for largest dictionary size (100 entries). Same C2 subnet (94.159.113.x) as fbdd83ad (.84, 66th), c4670e86 (.84, 76th), and e2568b43 (.84, 83rd). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/f51f632334bdfc53089666cd749bae9a890ca9333c9f5427b7fb5fe8ee901d7d.html]

|- 771c8752 — 6036279561681622040.js, JScript hybrid obfuscation: 65 random-noise variables, 192 assignments (last-wins semantics), noise-variable +-concatenation inside nested Function('return this')()[eval](...), WebDAV C2 94.159.113.204:8888 (single domain), payload 52442320412503.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, timeout 1 anti-emulation delay, no wordpad decoy, no sandbox gate, no nested try/catch decoys, no batch/polyglot layer, no dictionary lookup table. Ninetieth confirmed sibling. Notable: davww7root typo in WebDAV UNC path (first observed in family). Same C2 subnet (94.159.113.x) as fa8c6d74 (.204, 65th), ddf0c8bd (.204, 80th), and edfb0e0a (.204, 85th). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/771c875207b6a0094f83d53e923fbc56b4577c99cc7caf92ac675455ffd15e8d.html]

Related

||- e6252c92 — e6252c9256a37701fe38d5a4dabfeab6059a6ab3c3a2051dc3e3edb2fc780eac.bin (delivered as .js / .jse), JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 1,268-character extreme variable-name padding), WebDAV C2 94.159.113.79:8888 (single domain), payload 82643222928915.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, timeout 1 anti-emulation delay, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Eighty-fourth confirmed sibling. Same execution engine and C2 subnet (94.159.113.x) as fe261d49 (.79, 68th sibling), be172014 (.79, 74th sibling), and dc76a67d (.79, 79th sibling); shares extreme variable-name padding dialect with f8dce7df (2,478 chars, 64th), fe261d49 (1,794 chars, 68th), dbdb99f1 (2,337 chars, 78th), dc76a67d (1,255 chars, 79th), and dfb1eb98 (3,787 chars, 81st). Fourth-longest variable name in family. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/e6252c9256a37701fe38d5a4dabfeab6059a6ab3c3a2051dc3e3edb2fc780eac.html]

|- edfb0e0a — 1149620083211222912.js, JScript hybrid obfuscation: sequential variable-reassignment (212 assignments, 64 identifiers, last-wins semantics) + noise-variable +-concatenation inside Function('return this')()[eval](...), WebDAV C2 94.159.113.204:8888 (single domain), payload 18459543826105.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, timeout 1 anti-emulation delay, no wordpad decoy, no sandbox gate, no nested try/catch decoys, no batch/polyglot layer, no dictionary lookup table. Eighty-fifth confirmed sibling. First hybrid dialect combining reassignment + concatenation; same C2 subnet (94.159.113.x) as fa8c6d74 (.204, 65th sibling) and ddf0c8bd (.204, 80th sibling). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/edfb0e0abb507013faf97c63f4ec0f75acd3883cf1a7abb8b727f09eaeb42c92.html]

|- f01dca2e — f01dca2e327ae3f75c85bb161e231a1020d01660f28d3bc759084fb526c25dfb.bin (delivered as .js / .jse), JScript dictionary lookup-table obfuscation (100 entries, random noise keys, vukqn object), WebDAV C2 94.159.113.84:8888 (single domain), payload 30197980715234.dll, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Eighty-sixth confirmed sibling. Largest dictionary observed in family (100 entries, ties fbdd83ad and e2568b43). Same C2 subnet (94.159.113.x) as fbdd83ad (.84, 66th sibling), c4670e86 (.84, 76th), and e2568b43 (.84, 83rd). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/f01dca2e327ae3f75c85bb161e231a1020d01660f28d3bc759084fb526c25dfb.html]

||- f2316aaf — f2316aaf552b9926fa8c3398e3d15a3a770e320033d03e9546ff9d9cb29aaf9f.bin (delivered as .js / .jse), JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 3,451-character extreme variable-name padding), WebDAV C2 94.159.113.86:8888 (single domain), payload 9906127531487.dll, rundll32 ...,Entry execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Eighty-seventh confirmed sibling. Third-longest variable name in family (3,451 chars vs. 3,787-char record held by dfb1eb98). New C2 IP .86 in 94.159.113.x subnet (now twelve siblings on this subnet). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/f2316aaf552b9926fa8c3398e3d15a3a770e320033d03e9546ff9d9cb29aaf9f.html]

||- f346e80d — f346e80d14c241f4d015911188f474a9ce8f8aad603413b36107c281899fbc39.bin (delivered as .js / .jse), JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 3,395-character extreme variable-name padding), WebDAV C2 94.159.113.86:8888 (single domain), payload 1419215022203.dll, rundll32 ...,Entry execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys. Eighty-eighth confirmed sibling. Fourth-longest variable name in family (3,395 chars vs. 3,787-char record held by dfb1eb98). Same C2 IP .86 as f2316aaf (87th sibling). Static-only (JScript, not a binary). Report written. ^[/intel/analyses/f346e80d14c241f4d015911188f474a9ce8f8aad603413b36107c281899fbc39.html]

||- js-dictionary-lookup-100-entry-random-noise-keys

  • jscript-dictionary-100-entry-random-noise-keys-vyfrnbw — 100-entry random-noise dictionary (vyfrnbw object), 315 KB, 1,726 trailing no-op calls, direct WScript.Shell.run() execution without PowerShell wrapper, timeout 1 anti-emulation gate, WebDAV C2 94.159.113.84:8888, payload 206721718212887.dll. Largest 100-entry sibling in family. Observed in 8323305a. ^[/intel/analyses/8323305a810c70ec7d0b542f945b9585b866b288990a9e246a2acddb5f637189.html]
  • noise-variable-jscript-concatenation-65-entry

|- extreme-variable-name-padding-3122-char-rundll32-entry — 1.19 MB JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 3,122-character extreme variable-name padding — sixth-longest in family), WebDAV C2 94.159.113.86:8888 (single domain, same IP as 69th sibling ff3c6d0c, 87th sibling f2316aaf, and 88th sibling f346e80d), payload 1141610932572.dll, rundll32 ...,Entry execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys, no batch/polyglot layer. Ninety-first confirmed sibling. Third sibling on .86; confirms sustained activity on this endpoint. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/77aff542f6bde5a77bfd404ca560429a9474371fd2ad6cb619896b0a403cb0f1.html]

|- 53-variable-sequential-reassignment-fijnx-wrapper — 108 KB JScript sequential variable reassignment obfuscation (53 variables, last-wins semantics, pure reassignment — no dictionary lookup, no noise-variable concatenation), WebDAV C2 193.143.1.231:8888, payload 272191646614720.dll, direct regsvr32 /s via WScript.Shell.run(), no PowerShell wrapper, no wordpad decoy, no timeout gate, no sandbox gate, no batch/polyglot layer. fijnx() function wrapper assembles this[eval_expr](payload_expr). Ninety-second confirmed sibling. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/77e8e3b2a90c59ad8f792c9d306ebfc97036eab9b56b8297d96de44432d5a1a9.html]

||- 82d78891aa19 — JScript noise-variable concatenation obfuscation (65 entries, random lowercase noise names 15–20 chars, +-chained inside nested Function('return this')()), WebDAV C2 94.159.113.204:8888 (single domain), payload 164701625721624.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, timeout 1 anti-emulation delay, no wordpad decoy, no sandbox gate, no nested try/catch decoys, no batch/polyglot layer, no dictionary lookup table. Ninety-third confirmed sibling. Third pure-JScript noise-variable concatenation variant after fa8c6d74 (64 entries, 65th sibling) and ddf0c8bd (65 entries, 80th sibling); same C2 subnet (94.159.113.x) as fa8c6d74 (.204, 65th), ddf0c8bd (.204, 80th), edfb0e0a (.204, 85th), and 771c8752 (.204, 90th). Sixth sibling on .204; confirms sustained activity on this endpoint. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/82d78891aa1902262443dc4559d453af73f4567c03db9aa15e82bcfc2a312c46.html]

||- 8323305a — 28883307672689724950.js, JScript dictionary lookup-table obfuscation (100 entries, random noise keys, vyfrnbw object), WebDAV C2 94.159.113.84:8888 (single domain), payload 206721718212887.dll, regsvr32 /s execution, timeout 1 anti-emulation delay, no PowerShell wrapper, no wordpad decoy, no sandbox gate, no nested try/catch decoys, no batch/polyglot layer. Ninety-fourth confirmed sibling. Ties fbdd83ad, e2568b43, f51f6323, f01dca2e, and c4670e86 for largest dictionary size (100 entries). Sixth sibling on exact IP 94.159.113.84:8888. Notable divergence: direct WScript.Shell.run() execution without PowerShell -EncodedCommand wrapper — first 100-entry sibling to drop the wrapper. At 315 KB, largest 100-entry sibling observed. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/8323305a810c70ec7d0b542f945b9585b866b288990a9e246a2acddb5f637189.html]