[Plisskien]

New way of infecting computers by LUA scripts!!!

We have noticed an increased amount of LUA script posts that are infected, we believe there is one person behind this, who used about 10+ different accounts on this forum. This person puts this string at the end of the script source.

He calls it a font, it might be a font,


but in this case this is decrypted code


Uses 'PowerShell' to run the downloaded software, I'm not sure what this software is doing, but below you have links to VirusTotal, and HybridAnalysis.

VirusTotal

VirusTotal

www.virustotal.com

You must be registered for see links

We have noticed something like this in Aimware LUA, and Legendware v4 LUA only, we haven't seen anything similar in JS scripts, but please be extra conscious about this risk, if you see anything similar like this on forum report this thread as soon as possible, so we can investigate it! Keep in mind that scripts might be obfuscated. This can make it difficult to analyze any script. That’s why we had to change the rules, it is now forbidden.

Rules

A list of rules users must stick to.

hackvshack.net

 

[LeoOnLSD]

thanks for the information VirusTotal says what name this file uses if you infect the virus or RAT via Lua. In fact, it's nothing new that you can infect yourself via JavaScript or Luas, which is why you should stay away from freeed cheats that Luas offer.

I hardly use scripts for cheats and find you should use freeed / freeed Lua or further because the risk is too high

Screenshots:

https://imgur.com/5qPsz4J

You must be registered for see links

https://imgur.com/bCDOWfP

You must be registered for see links

 

[Bvar1337]

Th

New way of infecting computers by LUA scripts!!!

We have noticed an increased amount of LUA script posts that are infected, we believe there is one person behind this, who used about 10+ different accounts on this forum. This person puts this string at the end of the script source.

He calls it a font, it might be a font,
View attachment 1300

but in this case this is decrypted code
View attachment 1301

Uses 'PowerShell' to run the downloaded software, I'm not sure what this software is doing, but below you have links to VirusTotal, and HybridAnalysis.

VirusTotal

VirusTotal

www.virustotal.com

You must be registered for see links

We have noticed something like this in Aimware LUA, and Legendware v4 LUA only, we haven't seen anything similar in JS scripts, but please be extra conscious about this risk, if you see anything similar like this on forum report this thread as soon as possible, so we can investigate it! Keep in mind that scripts might be obfuscated. This can make it difficult to analyze any script. That’s why we had to change the rules, it is now forbidden.

Rules

A list of rules users must stick to.

hackvshack.net

Well tbh this isn't new. Never use freeed/freeed scripts with hidden or obfuscated code, it doesn't mean its malicious code but its better to be sure.

 

[Plisa]

New way of infecting computers by LUA scripts!!!

We have noticed an increased amount of LUA script posts that are infected, we believe there is one person behind this, who used about 10+ different accounts on this forum. This person puts this string at the end of the script source.

He calls it a font, it might be a font,
View attachment 1300

but in this case this is decrypted code
View attachment 1301

Uses 'PowerShell' to run the downloaded software, I'm not sure what this software is doing, but below you have links to VirusTotal, and HybridAnalysis.

VirusTotal

VirusTotal

www.virustotal.com

You must be registered for see links

We have noticed something like this in Aimware LUA, and Legendware v4 LUA only, we haven't seen anything similar in JS scripts, but please be extra conscious about this risk, if you see anything similar like this on forum report this thread as soon as possible, so we can investigate it! Keep in mind that scripts might be obfuscated. This can make it difficult to analyze any script. That’s why we had to change the rules, it is now forbidden.

Rules

A list of rules users must stick to.

hackvshack.net

How do u decrpyt it?