{
    "type": "bundle",
    "id": "bundle--a11edbd0-eae5-4b41-a0e5-eb15ef99c1ef",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--acadf73f-9f52-4ca7-9140-95ee34cc35b2",
            "created": "2023-03-08T12:52:02.580609Z",
            "modified": "2023-03-08T12:52:02.58069Z",
            "name": "Alienvault",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f3a518de-1314-4187-87c6-ebc6b352b394",
            "value": "ryongnamsan.edu"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1a9a3379-9e5a-4bf2-8694-91236eb4d235",
            "value": "barjuok.ryongnamsan.edu"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--c6fb0d4a-035f-427f-8f85-b2c54cd49022",
            "created": "2026-06-24T17:27:15.549103Z",
            "modified": "2026-06-24T17:27:15.549103Z",
            "name": "YARA Rule",
            "pattern": "rule nkminer_monero { meta: description = \"Detects installer of Monero miner that points to a NK domain\" author = \"cdoman@alienvault.com\" tlp = \"white\" license = \"MIT License\" strings: $a = \"82e999fb-a6e0-4094-aa1f-1a306069d1a5\" nocase wide ascii $b = \"4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS\" nocase wide ascii $c = \"barjuok.ryongnamsan.edu.kp\" nocase wide ascii $d = \"C:\\SoftwaresInstall\\soft\" nocase wide ascii $e = \"C:\\Windows\\Sys64\\intelservice.exe\" nocase wide ascii $f = \"C:\\Windows\\Sys64\\updater.exe\" nocase wide ascii $g = \"C:\\Users\\Jawhar\\documents\\\" nocase wide ascii condition: any of them }",
            "pattern_type": "yara",
            "valid_from": "2018-01-08T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--61784245-dd69-47cf-bab2-2770371a6ebc",
            "hashes": {
                "MD5": "6a261443299788af1467142d5f538b2c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--53c1cbbc-5334-4ab9-8dff-fbacc63da319",
            "hashes": {
                "MD5": "762c3249904a8bf76802effb54426655"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f741a5ba-c0e6-4bae-a15f-7e0b276ade75",
            "hashes": {
                "MD5": "42344bb45f351757e8638656e12a0135"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--dadda8f8-5749-4c72-9114-2d61ab1018d1",
            "value": "175.45.178.19"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--9cbad4f8-1b85-492a-829f-fca2c8b21c2b",
            "created_by_ref": "identity--acadf73f-9f52-4ca7-9140-95ee34cc35b2",
            "created": "2026-06-24T17:27:15.555659Z",
            "modified": "2026-06-24T17:27:15.555659Z",
            "name": "A North Korean Monero Cryptocurrency Miner",
            "published": "2018-01-08T00:00:00Z",
            "object_refs": [
                "identity--acadf73f-9f52-4ca7-9140-95ee34cc35b2",
                "domain-name--f3a518de-1314-4187-87c6-ebc6b352b394",
                "domain-name--1a9a3379-9e5a-4bf2-8694-91236eb4d235",
                "indicator--c6fb0d4a-035f-427f-8f85-b2c54cd49022",
                "file--61784245-dd69-47cf-bab2-2770371a6ebc",
                "file--53c1cbbc-5334-4ab9-8dff-fbacc63da319",
                "file--f741a5ba-c0e6-4bae-a15f-7e0b276ade75",
                "ipv4-addr--dadda8f8-5749-4c72-9114-2d61ab1018d1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.alienvault.com/blogs/labs-research/a-north-korean-monero-cryptocurrency-miner"
                }
            ]
        }
    ]
}