WARNING: This FiveM base “FiveM Royale Edition” comes with hidden backdoors/malware.
I performed a manual scan + Microsoft Defender, and hidden JavaScript files were found inside the resources. Defender flagged them as:
Phish:HTML/Redirector.MWA!MTB
The backdoor is obfuscated using XOR and executes remote code using:
new Function('global', d)(global)
The decoded code attempts to connect to:
In other words, the base downloads external code and executes it on the server. This is a confirmed backdoor.
Examples of infected files found:
resources\[custom]\origen_admin\node_modules\internal\.job_runner.js
resources\[custom]\[illegal]\randol_carheist\node_modules\internal\.cache.js
resources\[custom]\qb-carshowcase\server\utils\.initHooks.js
resources\[custom]\lc_fuel\client\lib\.rollup.config.js
resources\[custom]\origen_pausemenu\client\lib\.runtime.js
resources\[custom]\qb-radio\node_modules\internal\.main_dev.js
resources\[custom]\qb_bansystem\html\.main_dev.js
resources\[custom]\qb_report\html\.jest.config.js
resources\[custom]\qb_rubikcube\client\lib\.validate.js
resources\[custom]\qb_skydiving\data\.snapshot.js
resources\[custom]\qb_smoking\data\.rollup.config.js
resources\[custom]\qb_vehiclemenu\client\lib\.setupTests.js
resources\[custom]\[0r]\qua_critical_char\data\.initHooks.js
resources\[custom]\[0r]\s4-vehicleshop\data\.babelrc.js
resources\[custom]\[dep]\labubu_props\data\.initHooks.js
resources\[custom]\[jobs]\qb-henhousejob\server\utils\.jest.config.js
resources\[custom]\[jobs]\qb-irishpubjob\data\.sessionManager.js
resources\[custom]\[jobs]\qb-upnatoms\data\.build.js
resources\[custom]\[weapons]\kyros-weapon-pack-v5\data\.rollup.config.js
resources\[custom]\[weapons]\kyros-weapon-pack-v5\html\.syncQueue.js
resources\[defaultmaps]\[qua]\qua_nmotel_v2\server\utils\.job_runner.js
resources\[standalone]\interact-sound\client\lib\.internal.js
resources\[standalone]\memorygame\node_modules\internal\.sessionManager.js
A total of
44 files with the same backdoor pattern were found.
I do
not recommend anyone to use this base. Even after removing these files, the base is not trustworthy since the payload has been spread across multiple resources.
