{
  "date": "2019-03-19",
  "affected": "10.0.90.215",
  "family": "Remcos RAT and Dridex",
  "outcome": "partial",
  "reviewed_story": "Bobby Tiger’s workstation (10.0.90.215, BOBBY-TIGER-PC) downloaded test1.exe and f4.exe. The recovered hashes exactly match the publisher’s Remcos and Dridex payloads. The reference also describes distinct follow-on communications. The native summary accurately records the two transfers but stops before explaining the two-malware incident.",
  "matched": "Correct affected host/account, both payload servers and both exact SHA-256 hashes.",
  "gaps": "Remcos/Dridex identification and their later communications are omitted; neither recovered file appears in the short IOC list.",
  "caution": "TLS on port 3389 in this exercise is not automatically RDP. Downloading the files alone does not establish endpoint execution.",
  "hashes": [
    "2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85",
    "5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf"
  ],
  "case_number": 13,
  "name": "LittleTigers",
  "analysis_id": "bd9602ed-341a-4123-aae3-9fafa5731518",
  "capture_sha256": "257ba51a573232f7c2a8b43b55e127e793abe0bf067bd55f40dbee398fde6520",
  "summary_id": "investigation-summary:9e228f2a-4391-46bf-98a8-95be922c970f",
  "native_summary_saved": true,
  "affected_ip_in_short_report": true,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2019/03/19/2019-03-19-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:42:58.395448+00:00",
    "zip_sha256": "e962f12cf054d61bc2d5ba23780a84752655ef4deb3637e54bbc3aff46d755a9",
    "pdf_sha256": "482661cef0b7058525d6b663553b9a4132f51571d95ff002e5980f3537705480",
    "archive_member": "2019-03-19-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2019/03/19/page2.html",
  "reference_hash_checks": [
    {
      "sha256": "2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-0a0a4527e8ee1e79f9cdb1d2",
      "size_bytes": 811520,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://209.141.34.8/test1.exe",
          "client_ip": "10.0.90.215",
          "server_ip": "209.141.34.8",
          "tcp_stream": 48,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 754,
          "response_frame": 1523
        }
      ],
      "present_in_short_claim_text": true,
      "in_short_ioc_list": false
    },
    {
      "sha256": "5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-ac09c3d76fae46bbebbe3b10",
      "size_bytes": 176128,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://217.23.14.81/f4.exe",
          "client_ip": "10.0.90.215",
          "server_ip": "217.23.14.81",
          "tcp_stream": 50,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 1553,
          "response_frame": 1713
        }
      ],
      "present_in_short_claim_text": true,
      "in_short_ioc_list": false
    }
  ],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}