URL:

http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe

Full analysis: https://app.any.run/tasks/d8247243-96ef-44dc-aba4-98568ed34901
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 12, 2021, 14:11:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

64183425926F2603E99C84916588F27F

SHA1:

5732D6A2F54E561F0B8FE5E72C2DA6009AEFD5FB

SHA256:

47D1D7C84111F8B6DB94C5FB67803E2A7057B3FEA14ACDC9AC1504422271A2F0

SSDEEP:

3:N1KbYELJe2WAX+XCKXAWkCJsWgM0LKDgXLNn:CdLk2WAu5XAWkkZyKDgXLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • basilisk-latest.win32.installer.exe (PID: 3936)
      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • SPR.exe (PID: 3712)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • SPR.exe (PID: 3532)
      • basilisk.exe (PID: 916)

    • Actions looks like stealing of personal data

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • basilisk.exe (PID: 860)

    • Drops executable file immediately after starts

      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)

    • Loads dropped or rewritten executable

      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)

  • SUSPICIOUS

    • Checks supported languages

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • WinRAR.exe (PID: 3064)
      • SPR.exe (PID: 3712)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • SPR.exe (PID: 3532)
      • basilisk.exe (PID: 916)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 328)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 328)
      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 860)
      • WinRAR.exe (PID: 3064)
      • basilisk.exe (PID: 1988)

    • Drops a file with a compile date too recent

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)

    • Drops a file with too old compile date

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)

    • Reads the computer name

      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • WinRAR.exe (PID: 3064)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)

    • Drops a file that was compiled in debug mode

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)

    • Creates/Modifies COM task schedule object

      • setup.exe (PID: 2384)

    • Reads default file associations for system extensions

      • setup.exe (PID: 2384)

    • Creates a directory in Program Files

      • setup.exe (PID: 2384)

    • Creates files in the program directory

      • setup.exe (PID: 2384)

    • Creates a software uninstall entry

      • setup.exe (PID: 2384)

    • Changes default file association

      • setup.exe (PID: 2384)

    • Searches for installed software

      • setup.exe (PID: 2384)

    • Creates files in the user directory

      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 1988)

    • Reads the date of Windows installation

      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Reads CPU info

      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)

    • Reads Environment values

      • basilisk.exe (PID: 860)

    • Reads the time zone

      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Uses RUNDLL32.EXE to load library

      • basilisk.exe (PID: 1988)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3128)
      • iexplore.exe (PID: 328)
      • rundll32.exe (PID: 3620)
      • chrome.exe (PID: 3164)
      • chrome.exe (PID: 2988)
      • chrome.exe (PID: 356)
      • chrome.exe (PID: 2704)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3128)

    • Checks supported languages

      • iexplore.exe (PID: 328)
      • iexplore.exe (PID: 3128)
      • rundll32.exe (PID: 3620)
      • chrome.exe (PID: 3164)
      • chrome.exe (PID: 356)
      • chrome.exe (PID: 3168)
      • chrome.exe (PID: 2988)
      • chrome.exe (PID: 3000)
      • chrome.exe (PID: 740)
      • chrome.exe (PID: 628)
      • chrome.exe (PID: 668)
      • chrome.exe (PID: 2704)
      • chrome.exe (PID: 1504)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3128)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3128)
      • chrome.exe (PID: 2988)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3128)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3128)

    • Application launched itself

      • iexplore.exe (PID: 3128)
      • chrome.exe (PID: 3164)

    • Changes internet zones settings

      • iexplore.exe (PID: 3128)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3128)
      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Manual execution by user

      • basilisk.exe (PID: 1988)
      • chrome.exe (PID: 3164)

    • Dropped object may contain Bitcoin addresses

      • basilisk.exe (PID: 1988)

    • Reads the hosts file

      • chrome.exe (PID: 3164)
      • chrome.exe (PID: 2988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
25
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe basilisk-latest.win32.installer.exe no specs basilisk-latest.win32.installer.exe setup.exe basilisk.exe helper.exe winrar.exe spr.exe no specs basilisk.exe no specs basilisk.exe rundll32.exe no specs basilisk.exe no specs spr.exe no specs basilisk.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3128"C:\Program Files\Internet Explorer\iexplore.exe" "http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\user32.dll
328"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3128 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
3936"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe—iexplore.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
MEDIUM
Description:
UXP installer
Exit code:
3221226540
Version:
1.2
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\basilisk-latest.win32.installer.exe
c:\windows\system32\ntdll.dll
3052"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe
iexplore.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
UXP installer
Exit code:
0
Version:
1.2
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\basilisk-latest.win32.installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
2384.\setup.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\setup.exe
basilisk-latest.win32.installer.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
Basilisk Installer
Exit code:
0
Version:
52.9.2020.11.25
Modules
Images
c:\users\admin\appdata\local\temp\7zsceb2f81b\setup.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
860"C:\Program Files\Basilisk\basilisk.exe"C:\Program Files\Basilisk\basilisk.exe
setup.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
Basilisk
Exit code:
0
Version:
4.7.0
Modules
Images
c:\program files\basilisk\basilisk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\basilisk\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2808"C:\Program Files\Basilisk\uninstall\helper.exe" /UpdateShortcutAppUserModelIdsC:\Program Files\Basilisk\uninstall\helper.exe
basilisk.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
Basilisk Helper
Exit code:
2
Version:
52.9.2020.11.25
Modules
Images
c:\program files\basilisk\uninstall\helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Burnin' Rubber Shift.zip"C:\Program Files\WinRAR\WinRAR.exe
basilisk.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3712"C:\Users\admin\AppData\Local\Temp\Rar$EXa3064.21053\BurninRubberShift\SPR.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3064.21053\BurninRubberShift\SPR.exe—WinRAR.exe
User:
admin
Company:
Adobe Systems, Inc.
Integrity Level:
HIGH
Description:
Adobe Projector
Exit code:
0
Version:
12.0.1r122
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3064.21053\burninrubbershift\spr.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2888"C:\Program Files\Basilisk\basilisk.exe" http://www.adobe.com/shockwave/download/?P1_Prod_Version=SWArchive12.0.1C:\Program Files\Basilisk\basilisk.exe—SPR.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
Basilisk
Exit code:
1
Version:
4.7.0
Modules
Images
c:\program files\basilisk\basilisk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\basilisk\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\version.dll
Total events
26 004
Read events
25 576
Write events
415
Delete events
13

Modification events

(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
624758128
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30910432
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
924916019
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30910432
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
149
Suspicious files
357
Text files
271
Unknown types
128

Dropped files

PID
Process
Filename
Type
328iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe.vang9ds.partial —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe —
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\browser\omni.ja —
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\browser\VisualElements\VisualElements_70.pngimage
MD5:3923D012D242D817BEABFCD4EBAE8C81
SHA256:64CC8E7678A21E31806AFBCFB9CD4C3CC24E7424B7FB7CC89A6C68C2A1712A01
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpibinary
MD5:935A043256110EA8342FAECF5CB31D45
SHA256:4C9B12CFF0A04156826A675F0F14F419FEE7A666ABB6788F78AC7711B279CCC9
328iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\basilisk-latest.win32.installer[1].exeexecutable
MD5:B8ECB6DB6869AA57E0EE6853853E6D83
SHA256:663B95B0FD380EEC33DAC6033DA41A5BF02E69588B221F99699C10046B0A0A66
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{62DDB3F4-13D3-11EC-A9A3-12A9866C77DE}.datbinary
MD5:6CD37039D93BC6E903A657FED8723686
SHA256:E48A098C24A3D130F4427F084F1FA521BA9280ECF0657878DFCA13D754911B92
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\icudt58l.dat —
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\omni.ja —
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\freebl3.chkbinary
MD5:E0AE3842A79A0BBF6279E4261B8BFC14
SHA256:0B2D562E17C9F0285118188744448129DBA284F96FACFD07A8569D44DA3A5D2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
59
TCP/UDP connections
225
DNS requests
279
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
3128
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
US
der
631 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
3128
iexplore.exe
GET
200
2.16.186.56:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?671968e788165e16
unknown
compressed
4.70 Kb
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3128
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3128
iexplore.exe
2.16.186.56:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
2.16.186.81:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
3128
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
328
iexplore.exe
104.21.48.45:80
eu.basilisk-browser.org
Cloudflare Inc
US
suspicious
860
basilisk.exe
172.67.177.156:443
eu.basilisk-browser.org
—
US
suspicious
860
basilisk.exe
172.67.177.156:80
eu.basilisk-browser.org
—
US
suspicious
860
basilisk.exe
52.250.42.157:443
duckduckgo.com
Microsoft Corporation
US
unknown
860
basilisk.exe
51.138.51.14:443
links.duckduckgo.com
Microsoft Corporation
GB
unknown

DNS requests

Domain
IP
Reputation
eu.basilisk-browser.org
  • 104.21.48.45
  • 172.67.177.156
suspicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
  • 2.16.186.81
  • 2.16.186.56
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
detectportal.palemoon.org
  • 80.255.7.132
  • 2a01:4a0:68:1::492a
unknown
www.basilisk-browser.org
  • 172.67.177.156
  • 104.21.48.45
  • 142.250.185.110
  • 2606:4700:3032::6815:302d
  • 2606:4700:3034::ac43:b19c
whitelisted
duckduckgo.com
  • 52.250.42.157
  • 40.114.177.156
whitelisted
ac.duckduckgo.com
  • 40.114.177.156
suspicious

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe