StingrayAhoy — reviewed investigation summary
Reference-assisted review, not native model output.
The reference describes Ursnif followed by AZORult on Kim Jooyoung’s SEOUL-4A67-PC (10.0.90.175). The recoverable Ursnif executable has SHA-256 50007a82…09e3a2. That exact hash also received the run’s only direct malicious-file reputation match, labelled Gozi by MalwareBazaar. Nevertheless, no validated native short report was saved.
Native result: withheld. No saved short incident story despite useful packet and reputation evidence.