{
  "date": "2019-02-23",
  "affected": "10.2.23.231",
  "family": "IcedID / Bokbot with Trickbot",
  "outcome": "partial",
  "reviewed_story": "The published investigation identifies IcedID and Trickbot on Ruby Ferguson’s FERGUSON-WIN-PC (10.2.23.231). Six executable downloads include files masquerading as images. The native summary finds suspicious downloads but describes only four files, then ambiguously says troll1.jpg was “also” downloaded. It does not explain the multi-stage infection.",
  "matched": "Correct host and image-extension executable activity.",
  "gaps": "Misses the complete six-payload account, user and two malware families; wording risks double-counting troll1.jpg. The extraction comparison below is separate from narrative completeness.",
  "caution": "The publisher reports unsuccessful ETERNALBLUE activity against the domain controller, not a confirmed second infected host.",
  "hashes": [
    "3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f",
    "d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4",
    "4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5",
    "f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a",
    "8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb",
    "38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312"
  ],
  "case_number": 14,
  "name": "StormTheory",
  "analysis_id": "5bff54cd-16de-44cb-a009-c88818ce138f",
  "capture_sha256": "f6d740aeaac9e7d23843b481b7cbc179117cd21fab2f0d82c0e94fe8ba092775",
  "summary_id": "investigation-summary:c9be30de-56b8-4144-a804-f2c124bf9bcc",
  "native_summary_saved": true,
  "affected_ip_in_short_report": true,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2019/02/23/2019-02-23-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:42:59.248639+00:00",
    "zip_sha256": "6fd7f906b41f5efb88dbcbcdad291467613c38c99b49bd8d394a157d37935c95",
    "pdf_sha256": "8744792e4bd53bf3888f3e63f0574ef474317fc8135aaef7c7f26641dfab91c1",
    "archive_member": "2019-02-23-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2019/02/23/page2.html",
  "reference_hash_checks": [
    {
      "sha256": "3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-64c04b868e21280de7169f44",
      "size_bytes": 270336,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://85.143.218.7/sin.png",
          "client_ip": "10.2.23.231",
          "server_ip": "85.143.218.7",
          "tcp_stream": 200,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 20146,
          "response_frame": 20903
        }
      ],
      "present_in_short_claim_text": false,
      "in_short_ioc_list": false
    },
    {
      "sha256": "d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-2a57148deacdd09c06651c07",
      "size_bytes": 168448,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://46.249.62.199/Sw9JKmXqaSj.exe",
          "client_ip": "10.2.23.231",
          "server_ip": "46.249.62.199",
          "tcp_stream": 109,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 6262,
          "response_frame": 6800
        }
      ],
      "present_in_short_claim_text": false,
      "in_short_ioc_list": false
    },
    {
      "sha256": "4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-c300c6cc1195496e5d11e6e0",
      "size_bytes": 270336,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://85.143.218.7/tin.png",
          "client_ip": "10.2.23.231",
          "server_ip": "85.143.218.7",
          "tcp_stream": 161,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 11986,
          "response_frame": 13356
        }
      ],
      "present_in_short_claim_text": false,
      "in_short_ioc_list": false
    },
    {
      "sha256": "f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-bc3e0c0ff9381dba43f4d332",
      "size_bytes": 2818560,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://46.249.62.199/Tinx86_14.exe",
          "client_ip": "10.2.23.231",
          "server_ip": "46.249.62.199",
          "tcp_stream": 110,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 6249,
          "response_frame": 11971
        }
      ],
      "present_in_short_claim_text": false,
      "in_short_ioc_list": false
    },
    {
      "sha256": "8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-162a2189c16314dce4cad0b7",
      "size_bytes": 122880,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://209.141.55.226/troll1.jpg",
          "client_ip": "10.2.23.231",
          "server_ip": "209.141.55.226",
          "tcp_stream": 105,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 3119,
          "response_frame": 3542
        }
      ],
      "present_in_short_claim_text": false,
      "in_short_ioc_list": false
    },
    {
      "sha256": "38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-a44db5d69b9bc8f3fdaaff4e",
      "size_bytes": 270336,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://85.143.218.7/win.png",
          "client_ip": "10.2.23.231",
          "server_ip": "85.143.218.7",
          "tcp_stream": 150,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 10966,
          "response_frame": 12777
        }
      ],
      "present_in_short_claim_text": false,
      "in_short_ioc_list": false
    }
  ],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}