{ "summary": { "new_identity_total": 52, "v2_packet_verified_identity": 52, "v3_packet_verified_identity": 52, "v3_publisher_literal_identity": 50, "declared_ioc_subset_total": 88, "v2_ioc_available": 87, "v3_ioc_available": 87, "v3_publisher_literal_ioc_available": 84, "not_measured": [ "autonomous family-classification accuracy", "full malicious-IOC recall", "benign-traffic specificity at scale", "live-provider coverage", "LLM prompt effectiveness" ] }, "cases": { "2024-11-26": { "source": "https://www.malware-traffic-analysis.net/2024/11/26/page2.html", "identities": [ { "host_ip": "10.11.26.183", "field": "ip", "packet_verified_value": "10.11.26.183", "publisher_literal": "10.11.26.183", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.11.26.183", "field": "mac", "packet_verified_value": "d0:57:7b:ce:fc:8b", "publisher_literal": "d0:57:7b:ce:fc:8b", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.11.26.183", "field": "hostname", "packet_verified_value": "DESKTOP-B8TQK49", "publisher_literal": "DESKTOP-B8TQK49", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.11.26.183", "field": "account", "packet_verified_value": "oboomwald", "publisher_literal": "oboomwald", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "194.180.191.64", "publisher_literal": "194.180.191.164", "v2_available": true, "v3_available": true, "v3_literal_available": false }, { "value": "modandcrackedapk.com", "publisher_literal": "modandcrackedapk.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "classicgrand.com", "publisher_literal": "classicgrand.com", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "Native NetSupport User-Agent, cleartext port 443 and periodic callbacks support the tool identification. The delivery-chain explanation and malicious authorization context require the publisher or endpoint evidence. Shared site visits alone do not prove causation.", "publisher_conflicts": [ { "field": "c2_ip", "published": "194.180.191.164", "packet_value": "194.180.191.64", "reason": "Summary IOC conflicts with its own walkthrough and the packet destinations." } ], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": true, "exported_objects": 66, "hashed_bytes": 3596, "hashed_objects": 66, "omitted_unique_hashes": 0, "returned_unique_hashes": 11, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 11 }, "v3_http_inventory": { "compact_objects": 0, "complete": true, "detailed_objects": 11, "exported_objects": 66, "hashed_bytes": 3596, "hashed_objects": 66, "omitted_unique_hashes": 0, "returned_unique_hashes": 11, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 11 } }, "2024-09-04": { "source": "https://www.malware-traffic-analysis.net/2024/09/04/page2.html", "identities": [ { "host_ip": "172.17.0.99", "field": "ip", "packet_verified_value": "172.17.0.99", "publisher_literal": "172.17.0.99", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.17.0.99", "field": "mac", "packet_verified_value": "18:3d:a2:b6:8d:c4", "publisher_literal": "18:3d:a2:b6:8d:c4", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.17.0.99", "field": "hostname", "packet_verified_value": "DESKTOP-RNVO9AT", "publisher_literal": "DESKTOP-RNVO9AT", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.17.0.99", "field": "account", "packet_verified_value": "afletcher", "publisher_literal": "afletcher", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "79.124.78.197", "publisher_literal": "79.124.78.197", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "The engine retains the three PHP request paths and repeated POST activity, but does not independently identify Koi Stealer. The publisher bases that label on supplied ETPRO alerts, which were not fed to this PCAP-only run.", "publisher_conflicts": [], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": true, "exported_objects": 54, "hashed_bytes": 215, "hashed_objects": 54, "omitted_unique_hashes": 0, "returned_unique_hashes": 6, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 6 }, "v3_http_inventory": { "compact_objects": 0, "complete": true, "detailed_objects": 6, "exported_objects": 54, "hashed_bytes": 215, "hashed_objects": 54, "omitted_unique_hashes": 0, "returned_unique_hashes": 6, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 6 } }, "2024-08-15": { "source": "https://www.malware-traffic-analysis.net/2024/08/15/page2.html", "identities": [ { "host_ip": "10.8.15.133", "field": "ip", "packet_verified_value": "10.8.15.133", "publisher_literal": "10.8.15.133", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.8.15.133", "field": "mac", "packet_verified_value": "00:1c:bf:03:54:82", "publisher_literal": "00:1c:bf:03:54:82", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.8.15.133", "field": "hostname", "packet_verified_value": "DESKTOP-H8ALZBV", "publisher_literal": "DESKTOP-H8ALZBV", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.8.15.133", "field": "account", "packet_verified_value": "plucero", "publisher_literal": "plucero", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "104.21.55.70", "publisher_literal": "104.21.55.70", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "172.67.170.159", "publisher_literal": "172.67.170.169", "v2_available": true, "v3_available": true, "v3_literal_available": false }, { "value": "72.5.43.29", "publisher_literal": "72.5.43.29", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "quote.checkfedexexp.com", "publisher_literal": "quote.checkfedexexp.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "business.checkfedexexp.com", "publisher_literal": "business.checkfedexexp.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5", "publisher_literal": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "dab98819d1d7677a60f5d06be210d45b74ae5fd8cf0c24ec1b3766e25ce6dc2c", "publisher_literal": "dab98819d1d7677a60f5d06be210d45b74ae5fd8cf0c24ec1b3766e25ce6dc2c", "v2_available": false, "v3_available": false, "v3_literal_available": false }, { "value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6", "publisher_literal": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "The downloaded ZIP/DLL hashes and callback evidence are available, but the JavaScript child hash requires safe archive extraction outside this decoder's no-unpacking profile. The encrypted follow-up URL path and WarmCookie classification are publisher context, not independent packet conclusions.", "publisher_conflicts": [ { "field": "followup_ip", "published": "172.67.170.169", "packet_value": "172.67.170.159", "reason": "Packet TLS/flow evidence uses .159. The published full HTTPS path is not visible from encrypted PCAP metadata." } ], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": true, "exported_objects": 322, "hashed_bytes": 3449794, "hashed_objects": 322, "omitted_unique_hashes": 0, "returned_unique_hashes": 18, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 18 }, "v3_http_inventory": { "compact_objects": 0, "complete": true, "detailed_objects": 18, "exported_objects": 322, "hashed_bytes": 3449794, "hashed_objects": 322, "omitted_unique_hashes": 0, "returned_unique_hashes": 18, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 18 } }, "2024-07-30": { "source": "https://www.malware-traffic-analysis.net/2024/07/30/page2.html", "identities": [ { "host_ip": "172.16.1.66", "field": "ip", "packet_verified_value": "172.16.1.66", "publisher_literal": "172.16.1.66", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.1.66", "field": "mac", "packet_verified_value": "00:1e:64:ec:f3:08", "publisher_literal": "00:1e:64:ec:f3:08", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.1.66", "field": "hostname", "packet_verified_value": "DESKTOP-SKBR25F", "publisher_literal": "DESKTOP-SKBR25F", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.1.66", "field": "account", "packet_verified_value": "ccollier", "publisher_literal": "ccollier", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "141.98.10.79", "publisher_literal": "141.98.10.69", "v2_available": true, "v3_available": true, "v3_literal_available": false }, { "value": "github.com", "publisher_literal": "github.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "objects.githubusercontent.com", "publisher_literal": "objects.githubusercontent.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "repo1.maven.org", "publisher_literal": "repo1.maven.org", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "ip-api.com", "publisher_literal": "ip-api.com", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "V2 missed meaningful non-web behavior. V3 reports the literal structured software/host/account announcement and sustained custom TCP flow. STRRAT is directly visible as a self-reported label, not cryptographically authenticated attribution. File-sharing domains and public-IP services are not inherently malicious.", "publisher_conflicts": [ { "field": "c2_ip", "published": "141.98.10.69", "packet_value": "141.98.10.79", "reason": "Actual TCP/12132 endpoint is .79; frame 9119 includes the literal STRRAT software label." } ], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": true, "exported_objects": 2, "hashed_bytes": 316, "hashed_objects": 2, "omitted_unique_hashes": 0, "returned_unique_hashes": 2, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 2 }, "v3_http_inventory": { "compact_objects": 0, "complete": true, "detailed_objects": 2, "exported_objects": 2, "hashed_bytes": 316, "hashed_objects": 2, "omitted_unique_hashes": 0, "returned_unique_hashes": 2, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 2 } }, "2022-03-21": { "source": "https://www.malware-traffic-analysis.net/2022/03/21/page2.html", "identities": [ { "host_ip": "10.0.19.14", "field": "ip", "packet_verified_value": "10.0.19.14", "publisher_literal": "10.0.18.14", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": false }, { "host_ip": "10.0.19.14", "field": "mac", "packet_verified_value": "00:60:52:b7:33:0f", "publisher_literal": "00:60:52:b7:33:0f", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.0.19.14", "field": "hostname", "packet_verified_value": "DESKTOP-5QS3D5D", "publisher_literal": "DESKTOP-5QS3D5D", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.0.19.14", "field": "account", "packet_verified_value": "patrick.zimmerman", "publisher_literal": "patrick.zimmerman", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "188.166.154.118", "publisher_literal": "188.166.154.118", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "157.245.142.66", "publisher_literal": "157.245.142.66", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "160.153.32.99", "publisher_literal": "160.153.32.99", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "91.193.16.181", "publisher_literal": "91.193.16.181", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "23.227.198.203", "publisher_literal": "23.227.198.203", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "oceriesfornot.top", "publisher_literal": "oceriesfornot.top", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "antnosience.com", "publisher_literal": "antnosience.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "suncoastpinball.com", "publisher_literal": "suncoastpinball.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "otectagain.top", "publisher_literal": "otectagain.top", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "seaskysafe.com", "publisher_literal": "seaskysafe.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "dilimoretast.com", "publisher_literal": "dilimoretast.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "filebin.net", "publisher_literal": "filebin.net", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "situla.bitbit.net", "publisher_literal": "situla.bitbit.net", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "bupdater.com", "publisher_literal": "bupdater.com", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "The engine retains identity and infrastructure observations, but does not independently classify IcedID or Cobalt Strike. Encrypted sessions and a nonstandard TLS port are insufficient for a definitive malware-family label without dated signature or intelligence support.", "publisher_conflicts": [ { "field": "ip", "published": "10.0.18.14", "packet_value": "10.0.19.14", "reason": "The capture and stated 10.0.19.0/24 LAN identify .19.14." } ], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": true, "exported_objects": 2, "hashed_bytes": 394583, "hashed_objects": 2, "omitted_unique_hashes": 0, "returned_unique_hashes": 2, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 2 }, "v3_http_inventory": { "compact_objects": 0, "complete": true, "detailed_objects": 2, "exported_objects": 2, "hashed_bytes": 394583, "hashed_objects": 2, "omitted_unique_hashes": 0, "returned_unique_hashes": 2, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 2 } }, "2022-02-23": { "source": "https://www.malware-traffic-analysis.net/2022/02/23/page2.html", "identities": [ { "host_ip": "172.16.0.131", "field": "ip", "packet_verified_value": "172.16.0.131", "publisher_literal": "172.16.0.131", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.131", "field": "mac", "packet_verified_value": "2c:27:d7:d2:06:f5", "publisher_literal": "2c:27:d7:d2:06:f5", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.131", "field": "hostname", "packet_verified_value": "DESKTOP-VD151O7", "publisher_literal": "DESKTOP-VD151O7", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.131", "field": "account", "packet_verified_value": "tricia.becker", "publisher_literal": "tricia.becker", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.170", "field": "ip", "packet_verified_value": "172.16.0.170", "publisher_literal": "172.16.0.170", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.170", "field": "mac", "packet_verified_value": "00:12:f0:64:d1:d9", "publisher_literal": "00:12:f0:64:d1:d9", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.170", "field": "hostname", "packet_verified_value": "DESKTOP-W5TFTQY", "publisher_literal": "DESKTOP-W5TFTQY", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.170", "field": "account", "packet_verified_value": "everett.french", "publisher_literal": "everett.french", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.149", "field": "ip", "packet_verified_value": "172.16.0.149", "publisher_literal": "172.16.0.149", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.149", "field": "mac", "packet_verified_value": "00:1b:fc:7b:d1:c0", "publisher_literal": "00:1b:fc:7b:d1:c0", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.149", "field": "hostname", "packet_verified_value": "DESKTOP-KPQ9FDB", "publisher_literal": "DESKTOP-KPQ9FDB", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "172.16.0.149", "field": "account", "packet_verified_value": "nick.montgomery", "publisher_literal": "nick.montgomery", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "156.96.154.210", "publisher_literal": "156.96.154.210", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.katchybugonsale.com", "publisher_literal": "www.katchybugonsale.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.privilegetroissecurity.com", "publisher_literal": "www.privilegetroissecurity.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.hentainftxxx.com", "publisher_literal": "www.hentainftxxx.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.moonshot.properties", "publisher_literal": "www.moonshot.properties", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.nt-renewable.com", "publisher_literal": "www.nt-renewable.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.elsiepupz.com", "publisher_literal": "www.elsiepupz.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.jogoreviravolta.com", "publisher_literal": "www.jogoreviravolta.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.seo-python.com", "publisher_literal": "www.seo-python.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.db-propertygroup.com", "publisher_literal": "www.db-propertygroup.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.xn--pckwb0cye6947ajzku8opzi.com", "publisher_literal": "www.xn--pckwb0cye6947ajzku8opzi.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.czzhudi.com", "publisher_literal": "www.czzhudi.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.hydrocheats.com", "publisher_literal": "www.hydrocheats.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.riskprotek.com", "publisher_literal": "www.riskprotek.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.campdiscount.info", "publisher_literal": "www.campdiscount.info", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.mystore.guide", "publisher_literal": "www.mystore.guide", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.theperfecttrainer.com", "publisher_literal": "www.theperfecttrainer.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.globalsovereignbank.com", "publisher_literal": "www.globalsovereignbank.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.keysine.com", "publisher_literal": "www.keysine.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.chinadqwx.com", "publisher_literal": "www.chinadqwx.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.awridahmed.com", "publisher_literal": "www.awridahmed.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.ban-click.com", "publisher_literal": "www.ban-click.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.byaliciafryearson.com", "publisher_literal": "www.byaliciafryearson.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.krpano.pro", "publisher_literal": "www.krpano.pro", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.barrcoplumbingsupply.com", "publisher_literal": "www.barrcoplumbingsupply.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.32342240.xyz", "publisher_literal": "www.32342240.xyz", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.jmtmjz.com", "publisher_literal": "www.jmtmjz.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.freedomteaminc.com", "publisher_literal": "www.freedomteaminc.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.centroimprenta.xyz", "publisher_literal": "www.centroimprenta.xyz", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.e-scooters.frl", "publisher_literal": "www.e-scooters.frl", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.klassociates.info", "publisher_literal": "www.klassociates.info", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "dalgahavuzu.com", "publisher_literal": "dalgahavuzu.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "www.ajaxmatters.com", "publisher_literal": "www.ajaxmatters.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "135.148.121.246", "publisher_literal": "135.148.121.246", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "144.217.88.125", "publisher_literal": "144.217.88.125", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "134.209.156.68", "publisher_literal": "134.209.156.68", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3", "publisher_literal": "14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "All three clients must remain separate. V2 omitted 2,136 unique hashes from its detailed artifact inventory; V3 retains compact overflow hashes for enrichment. Family-per-host attribution, SMTP email extraction and reversal of a downloaded binary remain outside the native profile. IOC list here is a declared subset of the long publisher list, not an exhaustive recall denominator.", "publisher_conflicts": [], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": false, "exported_objects": 2638, "hashed_bytes": 4922527, "hashed_objects": 2638, "omitted_unique_hashes": 2136, "returned_unique_hashes": 500, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 2636 }, "v3_http_inventory": { "compact_objects": 2136, "complete": true, "detailed_objects": 500, "exported_objects": 2638, "hashed_bytes": 4922527, "hashed_objects": 2638, "omitted_unique_hashes": 0, "returned_unique_hashes": 2636, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 2636 } }, "2022-01-07": { "source": "https://www.malware-traffic-analysis.net/2022/01/07/page2.html", "identities": [ { "host_ip": "192.168.1.216", "field": "ip", "packet_verified_value": "192.168.1.216", "publisher_literal": "192.168.1.216", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "192.168.1.216", "field": "mac", "packet_verified_value": "9c:5c:8e:32:58:f9", "publisher_literal": "95:5c:8e:32:58:f9", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": false }, { "host_ip": "192.168.1.216", "field": "hostname", "packet_verified_value": "DESKTOP-GXMYNO2", "publisher_literal": "DESKTOP-GXMYNO2", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "192.168.1.216", "field": "account", "packet_verified_value": "steve.smith", "publisher_literal": "steve.smith", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "2.56.57.108", "publisher_literal": "2.56.57.108", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "publisher_literal": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "publisher_literal": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "publisher_literal": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "publisher_literal": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "publisher_literal": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "Library downloads and the external endpoint are retained, but legitimate DLLs are not malware simply because a stealer retrieves them. The engine does not independently label OskiStealer or inspect the uploaded archive contents. Both conflicting observed hostname spellings remain evidence, not silently corrected. Hash list is a declared subset.", "publisher_conflicts": [ { "field": "mac", "published": "95:5c:8e:32:58:f9", "packet_value": "9c:5c:8e:32:58:f9", "reason": "Ethernet source evidence is 9c, not 95." } ], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": true, "exported_objects": 22, "hashed_bytes": 3744940, "hashed_objects": 22, "omitted_unique_hashes": 0, "returned_unique_hashes": 14, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 14 }, "v3_http_inventory": { "compact_objects": 0, "complete": true, "detailed_objects": 14, "exported_objects": 22, "hashed_bytes": 3744940, "hashed_objects": 22, "omitted_unique_hashes": 0, "returned_unique_hashes": 14, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 14 } }, "2021-12-08": { "source": "https://isc.sans.edu/diary/28160", "identities": [ { "host_ip": "10.12.3.66", "field": "ip", "packet_verified_value": "10.12.3.66", "publisher_literal": "10.12.3.66", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.12.3.66", "field": "hostname", "packet_verified_value": "DESKTOP-LUOABV1", "publisher_literal": "DESKTOP-LUOABV1", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.12.3.66", "field": "account", "packet_verified_value": "darin.figueroa", "publisher_literal": "darin.figueroa", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "gamaes.shop", "publisher_literal": "gamaes.shop", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "newsaarctech.com", "publisher_literal": "newsaarctech.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "172.104.227.98", "publisher_literal": "172.104.227.98", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "163.172.50.82", "publisher_literal": "163.172.50.82", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "Identity and the listed infrastructure are packet-visible. Native family attribution, an infection-onset conclusion, and extraction/classification of 17 SMTP emails are not implemented. Publisher notes that the Emotet DLL cannot be exported from this capture. Do not interpret HTTP-export completeness as complete malware recovery.", "publisher_conflicts": [], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": false, "exported_objects": 2055, "hashed_bytes": 2729292, "hashed_objects": 2055, "omitted_unique_hashes": 1555, "returned_unique_hashes": 500, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 2055 }, "v3_http_inventory": { "compact_objects": 1555, "complete": true, "detailed_objects": 500, "exported_objects": 2055, "hashed_bytes": 2729292, "hashed_objects": 2055, "omitted_unique_hashes": 0, "returned_unique_hashes": 2055, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 2055 } }, "2021-10-22": { "source": "https://isc.sans.edu/diary/27998", "identities": [ { "host_ip": "10.10.22.157", "field": "ip", "packet_verified_value": "10.10.22.157", "publisher_literal": "10.10.22.157", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.10.22.157", "field": "hostname", "packet_verified_value": "DESKTOP-NZ875R4", "publisher_literal": "DESKTOP-NZ875R4", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.10.22.157", "field": "account", "packet_verified_value": "marcus.cobb", "publisher_literal": "marcus.cobb", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.10.22.158", "field": "ip", "packet_verified_value": "10.10.22.158", "publisher_literal": "10.10.22.158", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.10.22.158", "field": "hostname", "packet_verified_value": "DESKTOP-87WCE26", "publisher_literal": "DESKTOP-87WCE26", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.10.22.158", "field": "account", "packet_verified_value": "kevin.henderson", "publisher_literal": "kevin.henderson", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.10.22.156", "field": "ip", "packet_verified_value": "10.10.22.156", "publisher_literal": "10.10.22.156", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.10.22.156", "field": "hostname", "packet_verified_value": "DESKTOP-CFA3367", "publisher_literal": "DESKTOP-CFA3367", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.10.22.156", "field": "account", "packet_verified_value": "agnes.warren", "publisher_literal": "agnes.warren", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "kamuchehddhgfgf.ddns.net", "publisher_literal": "kamuchehddhgfgf.ddns.net", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "37.0.10.22", "publisher_literal": "37.0.10.22", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "sobolpand.top", "publisher_literal": "sobolpand.top", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "23.111.114.52", "publisher_literal": "23.111.114.52", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "publisher_literal": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "Three client identities and infrastructure are retained, but the original task asks for email-to-host mapping. The separate malicious-email archive was not supplied to the PCAP-only engine; those three mappings remain untested, not correct by implication. Family labels require additional evidence. Publisher explicitly notes one missing HTTPS acquisition in the PCAP.", "publisher_conflicts": [], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": true, "exported_objects": 6, "hashed_bytes": 3072260, "hashed_objects": 6, "omitted_unique_hashes": 0, "returned_unique_hashes": 4, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 4 }, "v3_http_inventory": { "compact_objects": 0, "complete": true, "detailed_objects": 4, "exported_objects": 6, "hashed_bytes": 3072260, "hashed_objects": 6, "omitted_unique_hashes": 0, "returned_unique_hashes": 4, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 4 } }, "2021-09-10": { "source": "https://www.malware-traffic-analysis.net/2021/09/10/page2.html", "identities": [ { "host_ip": "10.9.10.102", "field": "ip", "packet_verified_value": "10.9.10.102", "publisher_literal": "10.9.10.102", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.9.10.102", "field": "mac", "packet_verified_value": "00:4f:49:b1:e8:c3", "publisher_literal": "00:4f:49:b1:e8:c3", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.9.10.102", "field": "hostname", "packet_verified_value": "DESKTOP-KKITB6Q", "publisher_literal": "DESKTOP-KKITB6Q", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true }, { "host_ip": "10.9.10.102", "field": "account", "packet_verified_value": "hobart.gunnarsson", "publisher_literal": "hobart.gunnarsson", "v2_packet_agreement": true, "v3_packet_agreement": true, "v3_literal_agreement": true } ], "ioc_subset": [ { "value": "194.62.42.206", "publisher_literal": "194.62.42.206", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "simpsonsavingss.com", "publisher_literal": "simpsonsavingss.com", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "167.172.37.9", "publisher_literal": "167.172.37.9", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "94.158.245.52", "publisher_literal": "94.158.245.52", "v2_available": true, "v3_available": true, "v3_literal_available": true }, { "value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8", "publisher_literal": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8", "v2_available": true, "v3_available": true, "v3_literal_available": true } ], "publisher_context": "Identity, DLL hash and infrastructure can be compared directly. BazarLoader and TA551 are sourced publisher conclusions, not native actor attribution from the PCAP. A generic transfer finding must not be scored as independent campaign identification.", "publisher_conflicts": [], "malware_family_benchmark": "Not an autonomous family classifier; do not score literal software labels as independent attribution.", "v2_http_inventory": { "complete": true, "exported_objects": 46, "hashed_bytes": 3675348, "hashed_objects": 46, "omitted_unique_hashes": 0, "returned_unique_hashes": 45, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash", "unhashed_objects": 0, "unique_hashes": 45 }, "v3_http_inventory": { "compact_objects": 0, "complete": true, "detailed_objects": 45, "exported_objects": 46, "hashed_bytes": 3675348, "hashed_objects": 46, "omitted_unique_hashes": 0, "returned_unique_hashes": 45, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "unhashed_objects": 0, "unique_hashes": 45 } } } }