analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe

Full analysis: https://app.any.run/tasks/d8247243-96ef-44dc-aba4-98568ed34901
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 12, 2021, 14:11:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

64183425926F2603E99C84916588F27F

SHA1:

5732D6A2F54E561F0B8FE5E72C2DA6009AEFD5FB

SHA256:

47D1D7C84111F8B6DB94C5FB67803E2A7057B3FEA14ACDC9AC1504422271A2F0

SSDEEP:

3:N1KbYELJe2WAX+XCKXAWkCJsWgM0LKDgXLNn:CdLk2WAu5XAWkkZyKDgXLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • basilisk-latest.win32.installer.exe (PID: 3936)
      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • SPR.exe (PID: 3712)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)
      • SPR.exe (PID: 3532)

    • Actions looks like stealing of personal data

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • basilisk.exe (PID: 860)

    • Loads dropped or rewritten executable

      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)

    • Drops executable file immediately after starts

      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)

  • SUSPICIOUS

    • Checks supported languages

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 2888)
      • WinRAR.exe (PID: 3064)
      • SPR.exe (PID: 3712)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • SPR.exe (PID: 3532)
      • basilisk.exe (PID: 916)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 328)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 328)
      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)
      • WinRAR.exe (PID: 3064)
      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Drops a file with a compile date too recent

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)

    • Drops a file with too old compile date

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)

    • Reads the computer name

      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • helper.exe (PID: 2808)
      • WinRAR.exe (PID: 3064)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)

    • Drops a file that was compiled in debug mode

      • basilisk-latest.win32.installer.exe (PID: 3052)
      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 860)

    • Creates a software uninstall entry

      • setup.exe (PID: 2384)

    • Reads default file associations for system extensions

      • setup.exe (PID: 2384)

    • Creates/Modifies COM task schedule object

      • setup.exe (PID: 2384)

    • Reads the date of Windows installation

      • setup.exe (PID: 2384)
      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Changes default file association

      • setup.exe (PID: 2384)

    • Creates a directory in Program Files

      • setup.exe (PID: 2384)

    • Creates files in the user directory

      • setup.exe (PID: 2384)
      • helper.exe (PID: 2808)
      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Reads CPU info

      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 2888)
      • basilisk.exe (PID: 1988)
      • basilisk.exe (PID: 2188)
      • basilisk.exe (PID: 916)

    • Creates files in the program directory

      • setup.exe (PID: 2384)

    • Searches for installed software

      • setup.exe (PID: 2384)

    • Reads Environment values

      • basilisk.exe (PID: 860)

    • Reads the time zone

      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Uses RUNDLL32.EXE to load library

      • basilisk.exe (PID: 1988)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3128)
      • iexplore.exe (PID: 328)
      • rundll32.exe (PID: 3620)
      • chrome.exe (PID: 3164)
      • chrome.exe (PID: 356)
      • chrome.exe (PID: 2988)
      • chrome.exe (PID: 2704)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3128)
      • chrome.exe (PID: 2988)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3128)

    • Checks supported languages

      • iexplore.exe (PID: 328)
      • iexplore.exe (PID: 3128)
      • rundll32.exe (PID: 3620)
      • chrome.exe (PID: 3164)
      • chrome.exe (PID: 3168)
      • chrome.exe (PID: 356)
      • chrome.exe (PID: 3000)
      • chrome.exe (PID: 668)
      • chrome.exe (PID: 1504)
      • chrome.exe (PID: 740)
      • chrome.exe (PID: 628)
      • chrome.exe (PID: 2988)
      • chrome.exe (PID: 2704)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3128)

    • Application launched itself

      • iexplore.exe (PID: 3128)
      • chrome.exe (PID: 3164)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3128)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3128)

    • Changes internet zones settings

      • iexplore.exe (PID: 3128)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3128)
      • basilisk.exe (PID: 860)
      • basilisk.exe (PID: 1988)

    • Manual execution by user

      • basilisk.exe (PID: 1988)
      • chrome.exe (PID: 3164)

    • Dropped object may contain Bitcoin addresses

      • basilisk.exe (PID: 1988)

    • Reads the hosts file

      • chrome.exe (PID: 3164)
      • chrome.exe (PID: 2988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
25
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe basilisk-latest.win32.installer.exe no specs basilisk-latest.win32.installer.exe setup.exe basilisk.exe helper.exe winrar.exe spr.exe no specs basilisk.exe no specs basilisk.exe rundll32.exe no specs basilisk.exe no specs spr.exe no specs basilisk.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3128"C:\Program Files\Internet Explorer\iexplore.exe" "http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\user32.dll
328"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3128 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
3936"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe—iexplore.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
MEDIUM
Description:
UXP installer
Exit code:
3221226540
Version:
1.2
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\basilisk-latest.win32.installer.exe
c:\windows\system32\ntdll.dll
3052"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe
iexplore.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
UXP installer
Exit code:
0
Version:
1.2
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\basilisk-latest.win32.installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
2384.\setup.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\setup.exe
basilisk-latest.win32.installer.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
Basilisk Installer
Exit code:
0
Version:
52.9.2020.11.25
Modules
Images
c:\users\admin\appdata\local\temp\7zsceb2f81b\setup.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
860"C:\Program Files\Basilisk\basilisk.exe"C:\Program Files\Basilisk\basilisk.exe
setup.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
Basilisk
Exit code:
0
Version:
4.7.0
Modules
Images
c:\program files\basilisk\basilisk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\basilisk\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2808"C:\Program Files\Basilisk\uninstall\helper.exe" /UpdateShortcutAppUserModelIdsC:\Program Files\Basilisk\uninstall\helper.exe
basilisk.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
Basilisk Helper
Exit code:
2
Version:
52.9.2020.11.25
Modules
Images
c:\program files\basilisk\uninstall\helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Burnin' Rubber Shift.zip"C:\Program Files\WinRAR\WinRAR.exe
basilisk.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3712"C:\Users\admin\AppData\Local\Temp\Rar$EXa3064.21053\BurninRubberShift\SPR.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3064.21053\BurninRubberShift\SPR.exe—WinRAR.exe
User:
admin
Company:
Adobe Systems, Inc.
Integrity Level:
HIGH
Description:
Adobe Projector
Exit code:
0
Version:
12.0.1r122
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3064.21053\burninrubbershift\spr.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2888"C:\Program Files\Basilisk\basilisk.exe" http://www.adobe.com/shockwave/download/?P1_Prod_Version=SWArchive12.0.1C:\Program Files\Basilisk\basilisk.exe—SPR.exe
User:
admin
Company:
Moonchild Productions
Integrity Level:
HIGH
Description:
Basilisk
Exit code:
1
Version:
4.7.0
Modules
Images
c:\program files\basilisk\basilisk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\basilisk\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\version.dll
Total events
26 004
Read events
25 576
Write events
415
Delete events
13

Modification events

(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
624758128
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30910432
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
924916019
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30910432
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
149
Suspicious files
357
Text files
271
Unknown types
128

Dropped files

PID
Process
Filename
Type
328iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe.vang9ds.partial —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\basilisk-latest.win32.installer.exe —
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\browser\omni.ja —
MD5:—
SHA256:—
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpibinary
MD5:935A043256110EA8342FAECF5CB31D45
SHA256:4C9B12CFF0A04156826A675F0F14F419FEE7A666ABB6788F78AC7711B279CCC9
328iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\basilisk-latest.win32.installer[1].exeexecutable
MD5:B8ECB6DB6869AA57E0EE6853853E6D83
SHA256:663B95B0FD380EEC33DAC6033DA41A5BF02E69588B221F99699C10046B0A0A66
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\application.initext
MD5:D348725A7DD2C003977A1E4BD5DC493C
SHA256:C72E711C38F64A1A24C6CB5DB3EF02C0E7A7046575764A0661B67F89BB18C78A
3128iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1FFCBD0F84440005.TMPgmc
MD5:8AB7E15231EF0A5C324A56C331961E72
SHA256:0F9EF7B97D44754458C97486FBF9F4A92DADCF864AC1A8A7BF66A9AB6E148DF2
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{62DDB3F4-13D3-11EC-A9A3-12A9866C77DE}.datbinary
MD5:6CD37039D93BC6E903A657FED8723686
SHA256:E48A098C24A3D130F4427F084F1FA521BA9280ECF0657878DFCA13D754911B92
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\browser\VisualElements\VisualElements_70.pngimage
MD5:3923D012D242D817BEABFCD4EBAE8C81
SHA256:64CC8E7678A21E31806AFBCFB9CD4C3CC24E7424B7FB7CC89A6C68C2A1712A01
3052basilisk-latest.win32.installer.exeC:\Users\admin\AppData\Local\Temp\7zSCEB2F81B\core\browser\blocklist.xmlxml
MD5:D3438D5BDAC01CC9F338C7F5A04E6BE6
SHA256:B682A0ED08BB389C207BA2384306B6F5AC58875CD68439F3E94D529AF29559FF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
59
TCP/UDP connections
225
DNS requests
279
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3128
iexplore.exe
GET
200
2.16.186.56:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?671968e788165e16
unknown
compressed
4.70 Kb
whitelisted
860
basilisk.exe
GET
301
172.67.177.156:80
http://www.basilisk-browser.org/firstrun.shtml
US
html
169 b
whitelisted
328
iexplore.exe
GET
200
104.21.48.45:80
http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe
US
executable
40.0 Mb
suspicious
3128
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
US
der
631 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
860
basilisk.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
328
iexplore.exe
104.21.48.45:80
eu.basilisk-browser.org
Cloudflare Inc
US
suspicious
3128
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
2.16.186.81:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
3128
iexplore.exe
2.16.186.56:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
860
basilisk.exe
172.67.177.156:443
eu.basilisk-browser.org
—
US
suspicious
3128
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
860
basilisk.exe
40.114.178.124:443
external-content.duckduckgo.com
Microsoft Corporation
NL
unknown
860
basilisk.exe
51.138.51.14:443
links.duckduckgo.com
Microsoft Corporation
GB
unknown
860
basilisk.exe
40.114.177.156:443
duckduckgo.com
Microsoft Corporation
NL
suspicious
860
basilisk.exe
80.255.7.132:80
detectportal.palemoon.org
AS33891 Netzbetrieb GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
eu.basilisk-browser.org
  • 104.21.48.45
  • 172.67.177.156
suspicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
  • 2.16.186.81
  • 2.16.186.56
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
detectportal.palemoon.org
  • 80.255.7.132
  • 2a01:4a0:68:1::492a
unknown
www.basilisk-browser.org
  • 172.67.177.156
  • 104.21.48.45
  • 142.250.185.110
  • 2606:4700:3032::6815:302d
  • 2606:4700:3034::ac43:b19c
whitelisted
duckduckgo.com
  • 52.250.42.157
  • 40.114.177.156
whitelisted
ac.duckduckgo.com
  • 40.114.177.156
suspicious

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://eu.basilisk-browser.org/release/basilisk-latest.win32.installer.exe