gunra | 0ec306fe750b2704524fc5abe2acd78361fc5354377846db1e2c43cd3be81d7d

General

Target
sample2.zip
Size 67KB
Sample260807-ddkrzay1ez
SHA256 0ec306fe750b2704524fc5abe2acd78361fc5354377846db1e2c43cd3be81d7d
MD5 8ff623d79b469bc2a8480b297b0c8223
SHA1 a6ba1afb1234214f629bb007d87ef03285a2e515
SHA512 fe7a62ebcdd8b39dceffab2db9364c0bc47d6f101e6c5288894a935f49705f301b9bed4f1496b199efbe163efbbe40db93ccb5419b14e831e1ff264d67c99f3c
SSDEEP 1536:UAWTWv0P2ZLcdvRCv8+S0gadcQKcSOQuh3GnV3oH/vE:UAguvLlvfZdcjiQuGniHXE
TLSH
T1206302A931672A6B00BF43740B4D5818421FDA6E6B9E6A674AC5B18F2E13B804E3459F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\R3ADM3.txt

Ransom Note

YOUR ALL DATA HAVE BEEN ENCRYPTED! We have dumped your sensitive business data and then encrypted your side entire data. The only way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program, you must contact us. We guarantee that you can recover all your files safely and easily. But you have not so enough time. You can decrypt some of your files for free when you contact us. You Only Have 5 Days To Contact Us! How to contact us �. Download "Tor Browser" and install it. �. In the "Tor Browser" open this site here : http://apdk7hpbbquomgoxbhutegxco6btrz2ara3x2weqnx65tt45ba3sclyd.onion �. After signup and login to this site and contact Manger You need to contact "Manager" to recover all your data successfully. !!!DANGER !!! �O NOT MODIFY or try to RECOVER any files yourself.We WILL NOT be able to RESTORE them. �nd also we will publish your data on the dark web if there is no reply from you within 5 days. Publish URL: http://gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onion/ !!!DANGER !!!

URLs

http://apdk7hpbbquomgoxbhutegxco6btrz2ara3x2weqnx65tt45ba3sclyd.onion
http://gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onion/

Targets

- Target
  sample2.exe
- Size 194KB
- SHA256 854e5f77f788bbbe6e224195e115c749172cd12302afca370d4f9e3d53d005fd
- MD5 9a7c0adedc4c68760e49274700218507
- SHA1 77b294117cb818df701f03dc8be39ed9a361a038
- SHA512 7954fc2bfe0cf1a6ee4efdf6b56d896c34a836a40e03907d11f2c0c0785e5d8c6b377a77be60ffc8803557af3926f9d81f235332a745c998588ef21452c12e19
- SSDEEP 3072:V7cXqgLbJrV//R9gSRGT+1ddVeJWfmauiOFYDw93M+pc1e:7gn5VHgB86Wu8OFYxg
- TLSH
  T196141A01726ED6F6E09342F889529A02FEB631846B284BEFC3844B709D171D57DEDFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery execution gunra persistence privilege_escalation ransomware spyware stealer
- Family: Gunra
  Gunra is a C++ based ransomware that first emerged in April 2025.
  ransomware gunra
- Renames multiple (2403) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2