URL:

http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe

Full analysis: https://app.any.run/tasks/d8247243-96ef-44dc-aba4-98568ed34901
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 12, 2021, 14:11:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

64183425926F2603E99C84916588F27F

SHA1:

5732D6A2F54E561F0B8FE5E72C2DA6009AEFD5FB

SHA256:

47D1D7C84111F8B6DB94C5FB67803E2A7057B3FEA14ACDC9AC1504422271A2F0

SSDEEP:

3:N1KbYELJe2WAX+XCKXAWkCJsWgM0LKDgXLNn:CdLk2WAu5XAWkkZyKDgXLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • basilisk-latest.win32.installer.exe (PID: 3936)
      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 2888)
      • SPR.exe (PID: 3712)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • SPR.exe (PID: 3532)
      • basilisk.exe (PID: 916)

    • Drops executable file immediately after starts

      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)

    • Actions looks like stealing of personal data

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • basilisk.exe (PID: 860)

    • Loads dropped or rewritten executable

      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 328)
      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • WinRAR.exe (PID: 3064)
      • basilisk.exe (PID: 1988)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 328)

    • Drops a file with too old compile date

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)

    • Checks supported languages

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • SPR.exe (PID: 3712)
      • WinRAR.exe (PID: 3064)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • SPR.exe (PID: 3532)
      • basilisk.exe (PID: 916)

    • Drops a file with a compile date too recent

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)

    • Drops a file that was compiled in debug mode

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 860)

    • Creates/Modifies COM task schedule object

      • setup.exe (PID: 2384)

    • Creates a directory in Program Files

      • setup.exe (PID: 2384)

    • Creates a software uninstall entry

      • setup.exe (PID: 2384)

    • Reads the computer name

      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 860)
      • WinRAR.exe (PID: 3064)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)

    • Creates files in the user directory

      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Searches for installed software

      • setup.exe (PID: 2384)

    • Creates files in the program directory

      • setup.exe (PID: 2384)

    • Reads the date of Windows installation

      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Reads default file associations for system extensions

      • setup.exe (PID: 2384)

    • Changes default file association

      • setup.exe (PID: 2384)

    • Reads Environment values

      • basilisk.exe (PID: 860)

    • Reads CPU info

      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)

    • Reads the time zone

      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Uses RUNDLL32.EXE to load library

      • basilisk.exe (PID: 1988)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3128)
      • iexplore.exe (PID: 328)
      • rundll32.exe (PID: 3620)
      • chrome.exe (PID: 3164)
      • chrome.exe (PID: 356)
      • chrome.exe (PID: 2988)
      • chrome.exe (PID: 2704)

    • Changes internet zones settings

      • iexplore.exe (PID: 3128)

    • Application launched itself

      • iexplore.exe (PID: 3128)
      • chrome.exe (PID: 3164)

    • Checks supported languages

      • iexplore.exe (PID: 328)
      • iexplore.exe (PID: 3128)
      • rundll32.exe (PID: 3620)
      • chrome.exe (PID: 3164)
      • chrome.exe (PID: 3168)
      • chrome.exe (PID: 2988)
      • chrome.exe (PID: 3000)
      • chrome.exe (PID: 740)
      • chrome.exe (PID: 628)
      • chrome.exe (PID: 668)
      • chrome.exe (PID: 1504)
      • chrome.exe (PID: 2704)
      • chrome.exe (PID: 356)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3128)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3128)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3128)
      • chrome.exe (PID: 2988)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3128)
      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3128)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3128)

    • Manual execution by user

      • basilisk.exe (PID: 1988)
      • chrome.exe (PID: 3164)

    • Dropped object may contain Bitcoin addresses

      • basilisk.exe (PID: 1988)

    • Reads the hosts file

      • chrome.exe (PID: 2988)
      • chrome.exe (PID: 3164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
25
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe basilisk-latest.win32.installer.exe no specs basilisk-latest.win32.installer.exe setup.exe basilisk.exe helper.exe winrar.exe spr.exe no specs basilisk.exe no specs basilisk.exe rundll32.exe no specs basilisk.exe no specs spr.exe no specs basilisk.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3128 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
356"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,1909345259880135407,13626790644497567039,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1064 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
628"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,1909345259880135407,13626790644497567039,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
668"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,1909345259880135407,13626790644497567039,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
740"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,1909345259880135407,13626790644497567039,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
860"C:\Program Files\Basilisk\basilisk.exe"C:\Program Files\Basilisk\basilisk.exe
setup.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
Basilisk
Exit code:
0
Version:
4.7.0
Modules
Images
c:\program files\basilisk\basilisk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\basilisk\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
916"C:\Program Files\Basilisk\basilisk.exe" http://www.adobe.com/shockwave/download/?P1_Prod_Version=SWArchive12.0.1C:\Program Files\Basilisk\basilisk.exe—SPR.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
MEDIUM
Description:
Basilisk
Exit code:
1
Version:
4.7.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\basilisk\basilisk.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\program files\basilisk\mozglue.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
1504"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,1909345259880135407,13626790644497567039,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1988"C:\Program Files\Basilisk\basilisk.exe" C:\Program Files\Basilisk\basilisk.exe
Explorer.EXE
User:
admin
Company:
Moonchild Productions
Integrity Level:
MEDIUM
Description:
Basilisk
Exit code:
0
Version:
4.7.0
Modules
Images
c:\program files\basilisk\basilisk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\basilisk\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2188"C:\Program Files\Basilisk\basilisk.exe" -osint -url "http://go.microsoft.com/fwlink/?LinkId=57426&Ext=dcr"C:\Program Files\Basilisk\basilisk.exe—rundll32.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
MEDIUM
Description:
Basilisk
Exit code:
1
Version:
4.7.0
Modules
Images
c:\program files\basilisk\basilisk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\program files\basilisk\mozglue.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
Total events
26 004
Read events
25 576
Write events
415
Delete events
13

Modification events

(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
624758128
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30910432
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
924916019
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30910432
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
149
Suspicious files
357
Text files
271
Unknown types
128

Dropped files

PID
Process
Filename
Type
328iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe.vang9ds.partial —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe —
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\browser\omni.ja —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1FFCBD0F84440005.TMPgmc
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\icudt58l.dat —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{62DDB3F4-13D3-11EC-A9A3-12A9866C77DE}.datbinary
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\omni.ja —
MD5:—
SHA256:—
328iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\basilisk-latest.win32.installer[1].exeexecutable
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpibinary
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\application.initext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
59
TCP/UDP connections
225
DNS requests
279
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
328
iexplore.exe
GET
200
104.21.48.45:80
http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe
US
executable
40.0 Mb
suspicious
3128
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
US
der
631 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3128
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
328
iexplore.exe
104.21.48.45:80
eu.basilisk-browser.org
Cloudflare Inc
US
suspicious
—
—
2.16.186.81:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3128
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3128
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3128
iexplore.exe
2.16.186.56:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
860
basilisk.exe
80.255.7.132:80
detectportal.palemoon.org
AS33891 Netzbetrieb GmbH
DE
unknown
860
basilisk.exe
172.67.177.156:443
eu.basilisk-browser.org
—
US
suspicious
860
basilisk.exe
172.67.177.156:80
eu.basilisk-browser.org
—
US
suspicious

DNS requests

Domain
IP
Reputation
eu.basilisk-browser.org
  • 104.21.48.45
  • 172.67.177.156
suspicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
  • 2.16.186.81
  • 2.16.186.56
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
detectportal.palemoon.org
  • 80.255.7.132
  • 2a01:4a0:68:1::492a
unknown
www.basilisk-browser.org
  • 172.67.177.156
  • 104.21.48.45
  • 142.250.185.110
  • 2606:4700:3032::6815:302d
  • 2606:4700:3034::ac43:b19c
whitelisted
duckduckgo.com
  • 52.250.42.157
  • 40.114.177.156
whitelisted
ac.duckduckgo.com
  • 40.114.177.156
suspicious

Threats

PID
Process
Class
Message
328
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe