{
    "type": "bundle",
    "id": "bundle--5a3a3aca-a210-497a-9715-452c950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T03:00:33.000Z",
            "modified": "2017-12-22T03:00:33.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5a3a3aca-a210-497a-9715-452c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T03:00:33.000Z",
            "modified": "2017-12-22T03:00:33.000Z",
            "name": "OSINT - Rise of One More Mirai Worm Variant",
            "published": "2017-12-28T13:36:26Z",
            "object_refs": [
                "observed-data--5a3a3ad7-43e0-4b4c-9343-49b6950d210f",
                "url--5a3a3ad7-43e0-4b4c-9343-49b6950d210f",
                "x-misp-attribute--5a3a3aee-d9e0-43bf-a335-49e4950d210f",
                "indicator--5a3a3b1a-44f4-4bcf-953f-4af4950d210f",
                "indicator--5a3a3b1a-3398-40a6-8ed9-430d950d210f",
                "indicator--4a76a7c3-a63e-4701-882d-dcada5375372",
                "x-misp-object--402734d9-a857-45bd-9ae8-04657966f1c8",
                "indicator--10e3647b-ec40-4bba-9dae-9b62d89a7ff0",
                "x-misp-object--eae4f37c-fb66-445a-a462-c399c92638a3",
                "relationship--af6cbcca-9ed4-4d23-a6a1-4db39c78e3a0",
                "relationship--6408a22d-390c-4ccb-97ea-55f466ce9017"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "osint:source-type=\"blog-post\"",
                "malware_classification:malware-category=\"Botnet\"",
                "misp-galaxy:tool=\"Satori\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3a3ad7-43e0-4b4c-9343-49b6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-20T21:37:12.000Z",
            "modified": "2017-12-20T21:37:12.000Z",
            "first_observed": "2017-12-20T21:37:12Z",
            "last_observed": "2017-12-20T21:37:12Z",
            "number_observed": 1,
            "object_refs": [
                "url--5a3a3ad7-43e0-4b4c-9343-49b6950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5a3a3ad7-43e0-4b4c-9343-49b6950d210f",
            "value": "https://blog.fortinet.com/2017/12/12/rise-of-one-more-mirai-worm-variant"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5a3a3aee-d9e0-43bf-a335-49e4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-20T21:37:12.000Z",
            "modified": "2017-12-20T21:37:12.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "Not long after a new strain of the Akuma malware was discovered targeting ZyXEL devices with a new series of login/password attacks, FortiGuard Labs last week also began detecting strange scanning activities on uncommon TCP ports 52869 and 37215. We and other threat research teams quickly began to suspect that these were tied together, and that there was a new botnet out there.\r\n\r\nWith some focused research, the new Satori botnet, or \u00e2\u20ac\u0153Okiru\u00e2\u20ac\u009d \u00e2\u20ac\u201c as it was named by its malevolent author \u00e2\u20ac\u201c came to light. Okiru is a Japanese word that can be translated to \u00e2\u20ac\u0153to get up\u00e2\u20ac\u009d or \u00e2\u20ac\u0153to rise\u00e2\u20ac\u009d. Okiru first appeared on our radar at the end of October 2017, but during the first week of December it significantly stepped up its game by also adding worm capabilities to its arsenal. I will break down our analysis of this new botnet strain in this report."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3a3b1a-44f4-4bcf-953f-4af4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-20T10:27:38.000Z",
            "modified": "2017-12-20T10:27:38.000Z",
            "description": "Linux/Mirai.Y!tr.bdr",
            "pattern": "[file:hashes.SHA256 = 'e5fc493874f2a49e1a1594f3ee2254fa30e6dd69c6f24d24a08a562f03b2fd26']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-20T10:27:38Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3a3b1a-3398-40a6-8ed9-430d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-20T10:27:38.000Z",
            "modified": "2017-12-20T10:27:38.000Z",
            "description": "Linux/Mirai.Y!tr.bdr",
            "pattern": "[file:hashes.SHA256 = 'dd6e5607f137b6536097670a1211b4e20821ca136e2db26529948ff0a48555ff']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-20T10:27:38Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--4a76a7c3-a63e-4701-882d-dcada5375372",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-20T21:37:15.000Z",
            "modified": "2017-12-20T21:37:15.000Z",
            "pattern": "[file:hashes.MD5 = 'fc11c9cb0d4433143271f0f767864a30' AND file:hashes.SHA1 = '562c61a6413bf35c00a76e22d4cd8278658a0483' AND file:hashes.SHA256 = 'e5fc493874f2a49e1a1594f3ee2254fa30e6dd69c6f24d24a08a562f03b2fd26']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-20T21:37:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--402734d9-a857-45bd-9ae8-04657966f1c8",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-20T21:37:12.000Z",
            "modified": "2017-12-20T21:37:12.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/e5fc493874f2a49e1a1594f3ee2254fa30e6dd69c6f24d24a08a562f03b2fd26/analysis/1513339300/",
                    "category": "External analysis",
                    "comment": "Linux/Mirai.Y!tr.bdr",
                    "uuid": "5a3ad808-98b0-4301-aeb3-04a602de0b81"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "26/59",
                    "category": "Other",
                    "comment": "Linux/Mirai.Y!tr.bdr",
                    "uuid": "5a3ad808-ab94-4518-bf1b-04a602de0b81"
                },
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2017-12-15T12:01:40",
                    "category": "Other",
                    "comment": "Linux/Mirai.Y!tr.bdr",
                    "uuid": "5a3ad808-1360-4a31-be33-04a602de0b81"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--10e3647b-ec40-4bba-9dae-9b62d89a7ff0",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-20T21:37:15.000Z",
            "modified": "2017-12-20T21:37:15.000Z",
            "pattern": "[file:hashes.MD5 = 'eeab715dc67af05280c926dc4c4676f5' AND file:hashes.SHA1 = 'fc6569b13e4f0fb9a541f0eb4b0b179d34aadb4c' AND file:hashes.SHA256 = 'dd6e5607f137b6536097670a1211b4e20821ca136e2db26529948ff0a48555ff']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-20T21:37:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--eae4f37c-fb66-445a-a462-c399c92638a3",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-20T21:37:12.000Z",
            "modified": "2017-12-20T21:37:12.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/dd6e5607f137b6536097670a1211b4e20821ca136e2db26529948ff0a48555ff/analysis/1513706129/",
                    "category": "External analysis",
                    "comment": "Linux/Mirai.Y!tr.bdr",
                    "uuid": "5a3ad808-7ac8-4434-865d-04a602de0b81"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "28/59",
                    "category": "Other",
                    "comment": "Linux/Mirai.Y!tr.bdr",
                    "uuid": "5a3ad808-77cc-4147-805d-04a602de0b81"
                },
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2017-12-19T17:55:29",
                    "category": "Other",
                    "comment": "Linux/Mirai.Y!tr.bdr",
                    "uuid": "5a3ad808-0fac-4369-949d-04a602de0b81"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af6cbcca-9ed4-4d23-a6a1-4db39c78e3a0",
            "created": "2017-12-28T13:36:26.000Z",
            "modified": "2017-12-28T13:36:26.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--4a76a7c3-a63e-4701-882d-dcada5375372",
            "target_ref": "x-misp-object--402734d9-a857-45bd-9ae8-04657966f1c8"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6408a22d-390c-4ccb-97ea-55f466ce9017",
            "created": "2017-12-28T13:36:26.000Z",
            "modified": "2017-12-28T13:36:26.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--10e3647b-ec40-4bba-9dae-9b62d89a7ff0",
            "target_ref": "x-misp-object--eae4f37c-fb66-445a-a462-c399c92638a3"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}