6792d2d35d1f2a9dbe58b8b1e98f05ba5419bf7775d1520410069715ed891038

Analysis

max time kernel
1s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
07/11/2024, 10:15

Target
RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/node-gyp-build
Size 310B
Sample241107-maftaazlay
SHA256 2c34c104880b8ac95bea71c954c848697835b3aeeacbd6cb01369b237e2e295a
MD5 12cbf3babb786218def63efb615f8b6f
SHA1 acf59353111d1c24e1622d5fc86cb449cb182c61
SHA512 98f0acc66694d2b1732364f69f777b2df58c3cd477029c50b4cc62965dc0f7c518e149ecc9670283636aa92306559b1c7998fd2a1353d026107054aa7639c585
MD5 SHA1 SHA512

Score

3^/10

discovery

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	sed

/tmp/RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/node-gyp-build
/tmp/RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/node-gyp-build
1⤵
PID:722
- /bin/sed
  sed -e "s,\\\\,/,g"
  2⤵
  - Reads runtime system information
  PID:726
- /usr/bin/dirname
  dirname /tmp/RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/node-gyp-build
  2⤵
  PID:723
- /bin/uname
  uname
  2⤵
  PID:732

/usr/local/sbin/node
node /tmp/RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/../node-gyp-build/bin.js
1⤵
PID:722

/usr/local/bin/node
node /tmp/RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/../node-gyp-build/bin.js
1⤵
PID:722

/usr/sbin/node
node /tmp/RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/../node-gyp-build/bin.js
1⤵
PID:722

/usr/bin/node
node /tmp/RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/../node-gyp-build/bin.js
1⤵
PID:722

/sbin/node
node /tmp/RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/../node-gyp-build/bin.js
1⤵
PID:722

/bin/node
node /tmp/RevokeMsgPatcher.v2.0/LiteLoaderQQNT/plugins/qq-anti-recall/node_modules/.bin/../node-gyp-build/bin.js
1⤵
PID:722