{
  "date": "2019-04-15",
  "affected": "10.0.90.175",
  "family": "Ursnif, then AZORult",
  "outcome": "withheld",
  "reviewed_story": "The reference describes Ursnif followed by AZORult on Kim Jooyoung’s SEOUL-4A67-PC (10.0.90.175). The recoverable Ursnif executable has SHA-256 50007a82…09e3a2. That exact hash also received the run’s only direct malicious-file reputation match, labelled Gozi by MalwareBazaar. Nevertheless, no validated native short report was saved.",
  "matched": "No native-summary success. Separately, the extracted hash and direct MalwareBazaar record corroborate the first payload.",
  "gaps": "No saved short incident story despite useful packet and reputation evidence.",
  "caution": "The reputation record was queried in 2026 and first seen there in 2022; neither date is the date of this 2019 incident. Final retry awaits exact-transfer consent.",
  "hashes": [
    "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2"
  ],
  "case_number": 12,
  "name": "StingrayAhoy",
  "analysis_id": "0bb7a995-231c-4046-95ec-acea419eb7b4",
  "capture_sha256": "2d27b8be5a880af7cfd5a51bd9a184e546344afe42261c323b41e34b961a288c",
  "summary_id": null,
  "native_summary_saved": false,
  "affected_ip_in_short_report": false,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2019/04/15/2019-04-15-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:42:57.212593+00:00",
    "zip_sha256": "842057c6e23f0da9db59361537e383797136c56cd088e9de60ded225675fecbd",
    "pdf_sha256": "acebe0ce8ab27f2a49b9e9423ac8befb99147f0a15703e110ea49b754993a943",
    "archive_member": "2019-04-15-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2019/04/15/page2.html",
  "reference_hash_checks": [
    {
      "sha256": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-b57d8ac317ccada04eead7ea",
      "size_bytes": 328192,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://ljeffery54ae.top/skoex/po2.php?l=cupk6.fgs",
          "client_ip": "10.0.90.175",
          "server_ip": "91.240.87.19",
          "tcp_stream": 45,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 668,
          "response_frame": 997
        }
      ],
      "present_in_short_claim_text": false,
      "in_short_ioc_list": false
    }
  ],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}