{
  "date": "2019-06-22",
  "affected": "10.0.76.109",
  "family": "Rig exploit kit delivering KPOT Stealer",
  "outcome": "partial",
  "reviewed_story": "The reference identifies Rig exploit-kit delivery of KPOT Stealer to BANGKOK-8AC2-PC (10.0.76.109), used by edris.haight. Delivery involves 37.46.135[.]170; follow-on traffic uses 8.209.83[.]76 and fghjkmgru34[.]site. The native report notices the executable-declared transfer but misses the delivery mechanism, stealer and later communications.",
  "matched": "Correct affected host and delivery server.",
  "gaps": "No human user, exploit-kit interpretation, KPOT label or post-infection destination in the short report. A computer account is shown instead of the person’s account.",
  "caution": "The answer’s hash is for malware retrieved from the infected host. It is not assumed to equal the encoded exploit-kit network object; family identification also uses external alerts.",
  "hashes": [],
  "case_number": 10,
  "name": "Phenomenoc",
  "analysis_id": "8879e360-655c-4073-beb9-68018699a4d4",
  "capture_sha256": "6a89013b9e9bc6d443810245b92f49db4df33c1671a43db03a6bbde8f2bc6e63",
  "summary_id": "investigation-summary:7ae590f3-65a9-43e6-a5a2-2f39852714f3",
  "native_summary_saved": true,
  "affected_ip_in_short_report": true,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2019/06/22/2019-06-22-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:42:55.413809+00:00",
    "zip_sha256": "15f75bf9f16ac02746325c3b70dc25a13e87ba2fae8217db9b9d58f721fc6ea9",
    "pdf_sha256": "f3aa569593168cfb0549b6df69e238fe228c592e499193f23469b65cc6c41cb3",
    "archive_member": "2019-06-22-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2019/06/22/page2.html",
  "reference_hash_checks": [],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}