gunra

Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
gunra ransomware
*/

rule gunra_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.gunra"
        description = "Detects gunra ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "gunra" ascii nocase
        $name2 = "GUNRA" ascii
        $onion  = "gunra.onion" ascii nocase

    condition:
        any of them
}

Your data has been encrypted, and we have taken copies of certain sensitive files.
This encryption was carried out for financial reasons, and a payment will be required before we can provide the tools needed to restore your data.
You will not be able to restore your data without our assistance. We can ensure full recovery if we work together.
To show that we are able to restore your files, we can decrypt a few non-critical files at no cost.
If we reach an agreement, we will keep all discussions private and delete the data we took.
Please see the contact information below for the next steps.
========================== How to Contact Us ==========================
Please download Tor Browser from the URL [redactado]
Then install and open it.
Then connect to the URL below and log in with the given credentials.
Contact URL: [redactado]
Client ID: [snip]
Initial password: [snip]

• https://www.ransomware.live/group/gunra

• Not Found
  4
• Manufacturing
  4
• Professional Services
  3
• Healthcare
  2
• Technology