{
    "type": "bundle",
    "id": "bundle--5ece2604-2a1f-425c-a359-00a738c65ef6",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--acadf73f-9f52-4ca7-9140-95ee34cc35b2",
            "created": "2023-03-08T12:52:02.580609Z",
            "modified": "2023-03-08T12:52:02.58069Z",
            "name": "Alienvault",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f3a518de-1314-4187-87c6-ebc6b352b394",
            "value": "ryongnamsan.edu"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f8cc18f1-5606-4fc8-ae35-c77cc44bbb03",
            "hashes": {
                "MD5": "6a261443299788af1467142d5f538b2c",
                "SHA-1": "8965381377a884aa68eeb451b3e62175968b0b04",
                "SHA-256": "c599f3ca3417169e4a620b8231f8a97ccc63e291b9e09c888e6807dd90f1f17c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6ea4d067-1781-41eb-8814-13904a80adc0",
            "hashes": {
                "MD5": "762c3249904a8bf76802effb54426655",
                "SHA-1": "0def199dbdb8dccf380511f67138088148ea83a3",
                "SHA-256": "42300b6a09f183ae167d7a11d9c6df21d022a5f02df346350d3d875d557d3b76"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--181ea8b0-3374-40b2-95de-919a8d174570",
            "hashes": {
                "MD5": "42344bb45f351757e8638656e12a0135",
                "SHA-1": "7cab4853c370a2dd299a5ab3ebeccfe17455cb43",
                "SHA-256": "0024e32c0199ded445c0b968601f21cc92fc0c534d2642f2dd64c1c978ff01f3"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1a9a3379-9e5a-4bf2-8694-91236eb4d235",
            "value": "barjuok.ryongnamsan.edu"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--c6fb0d4a-035f-427f-8f85-b2c54cd49022",
            "created": "2026-10-09T14:38:46.789957Z",
            "modified": "2026-10-09T14:38:46.789957Z",
            "name": "YARA Rule",
            "pattern": "rule nkminer_monero { meta: description = \"Detects installer of Monero miner that points to a NK domain\" author = \"cdoman@alienvault.com\" tlp = \"white\" license = \"MIT License\" strings: $a = \"82e999fb-a6e0-4094-aa1f-1a306069d1a5\" nocase wide ascii $b = \"4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS\" nocase wide ascii $c = \"barjuok.ryongnamsan.edu.kp\" nocase wide ascii $d = \"C:\\SoftwaresInstall\\soft\" nocase wide ascii $e = \"C:\\Windows\\Sys64\\intelservice.exe\" nocase wide ascii $f = \"C:\\Windows\\Sys64\\updater.exe\" nocase wide ascii $g = \"C:\\Users\\Jawhar\\documents\\\" nocase wide ascii condition: any of them }",
            "pattern_type": "yara",
            "valid_from": "2018-01-08T00:00:00Z"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--dadda8f8-5749-4c72-9114-2d61ab1018d1",
            "value": "175.45.178.19"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--9cbad4f8-1b85-492a-829f-fca2c8b21c2b",
            "created_by_ref": "identity--acadf73f-9f52-4ca7-9140-95ee34cc35b2",
            "created": "2026-10-09T14:38:46.791784Z",
            "modified": "2026-10-09T14:38:46.791784Z",
            "name": "A North Korean Monero Cryptocurrency Miner",
            "published": "2018-01-08T00:00:00Z",
            "object_refs": [
                "identity--acadf73f-9f52-4ca7-9140-95ee34cc35b2",
                "domain-name--f3a518de-1314-4187-87c6-ebc6b352b394",
                "file--f8cc18f1-5606-4fc8-ae35-c77cc44bbb03",
                "file--6ea4d067-1781-41eb-8814-13904a80adc0",
                "file--181ea8b0-3374-40b2-95de-919a8d174570",
                "domain-name--1a9a3379-9e5a-4bf2-8694-91236eb4d235",
                "indicator--c6fb0d4a-035f-427f-8f85-b2c54cd49022",
                "ipv4-addr--dadda8f8-5749-4c72-9114-2d61ab1018d1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.alienvault.com/blogs/labs-research/a-north-korean-monero-cryptocurrency-miner"
                }
            ]
        }
    ]
}