{
  "date": "2020-01-30",
  "affected": "10.20.30.227",
  "family": "Hancitor",
  "outcome": "partial",
  "reviewed_story": "Alejandrina Hogue’s workstation (10.20.30.227, DESKTOP-4C02EMG) received sv.exe from gengrasjeepram[.]com, then posted to twereptale[.]com. The publisher identifies Hancitor and additional encrypted payload transfers from xolightfinance[.]com. The Claude summary correctly connects the first download and POST activity, while leaving execution and attribution unconfirmed.",
  "matched": "Correct workstation/user, executable download, hash and follow-on POST destinations.",
  "gaps": "Hancitor identification and the later encrypted payload stage are absent.",
  "caution": "api.ipify.org is an IP-discovery service, not inherently malicious. This case used a recorded Claude fallback, not OpenAI.",
  "hashes": [
    "995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda"
  ],
  "case_number": 4,
  "name": "Sol-Lightnet",
  "analysis_id": "05851801-c224-489b-b9da-9e5d035c60b4",
  "capture_sha256": "51c84227023072a05ed3b4cae03662c7df80780551b6119c8af97301472642d4",
  "summary_id": "investigation-summary:28fb5145-e166-4b00-abc3-e4b1ea541095",
  "native_summary_saved": true,
  "affected_ip_in_short_report": true,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2020/01/30/2020-01-30-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:42:42.932329+00:00",
    "zip_sha256": "07cdaa577e4deda07e5a5086d1c7687cb0002e94bc37e565b2e79c625a9fde1a",
    "pdf_sha256": "97f9b204528380f2a5ce60b2ef0fcf70faf205b25b118bb4e577c5c317a14b99",
    "archive_member": "2020-01-30-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2020/01/30/page2.html",
  "reference_hash_checks": [
    {
      "sha256": "995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-514d7133a43d58c3e612646a",
      "size_bytes": 81920,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://gengrasjeepram.com/sv.exe",
          "client_ip": "10.20.30.227",
          "server_ip": "49.51.133.162",
          "tcp_stream": 55,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 1169,
          "response_frame": 1235
        }
      ],
      "present_in_short_claim_text": true,
      "in_short_ioc_list": false
    }
  ],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}