import "hash"

rule bulwark_https_bulwarkblack_com_gunra_ransomware_vpn_compromise_incident_response
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/gunra-ransomware-vpn-compromise-incident-response/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:24:22Z"
        tlp = "TLP:CLEAR"
        indicator_count = "30"
    strings:
        $s0 = "datapub.news" ascii wide nocase  // Domains
        $s1 = "intel.breakglass.tech" ascii wide nocase  // Domains
        $s2 = "stopransomware.gov" ascii wide nocase  // Domains
        $s3 = "www.cloudsek.com" ascii wide nocase  // Domains
        $s4 = "www.cyfirma.com" ascii wide nocase  // Domains
        $s5 = "https://intel.breakglass.tech/post/gunra-ransomware-s-linux-variant-has-a-fatal-flaw-time-seeded-rand-makes-encrypted-files-recoverable-without-paying" ascii wide nocase  // URLs
        $s6 = "https://www.cloudsek.com/blog/inside-gunra-raas-from-affiliate-recruitment-on-the-dark-web-to-full-technical-dissection-of-their-locker" ascii wide nocase  // URLs
        $s7 = "https://www.cyfirma.com/research/gunra-ransomware-a-brief-analysis/" ascii wide nocase  // URLs
        $s8 = "103.125.234.14" ascii wide nocase  // IPv4
        $s9 = "123.184.143.105" ascii wide nocase  // IPv4
        $s10 = "123.244.187.144" ascii wide nocase  // IPv4
        $s11 = "123.246.37.108" ascii wide nocase  // IPv4
        $s12 = "182.204.16.112" ascii wide nocase  // IPv4
        $s13 = "182.204.21.240" ascii wide nocase  // IPv4
        $s14 = "182.204.39.118" ascii wide nocase  // IPv4
        $s15 = "211.21.210.181" ascii wide nocase  // IPv4
        $s16 = "23.239.119.2" ascii wide nocase  // IPv4
        $s17 = "23.239.119.3" ascii wide nocase  // IPv4
        $s18 = "23.239.119.4" ascii wide nocase  // IPv4
        $s19 = "23.239.119.5" ascii wide nocase  // IPv4
        $s20 = "23.239.119.6" ascii wide nocase  // IPv4
        $s21 = "67.43.53.10" ascii wide nocase  // IPv4
        $s22 = "70.36.99.82" ascii wide nocase  // IPv4
        $s23 = "86.54.28.216" ascii wide nocase  // IPv4
        $s24 = "91.201.66.146" ascii wide nocase  // IPv4
        $s25 = "contact@cisa.dhs.gov" ascii wide nocase  // Email Addresses
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "2dc70a12d158d437e45a55b1d52f3d61c6082a1e1667573302ba3b62813e2751" or
        hash.sha256(0, filesize) == "834efe9b392c6c000877ea5613a079445affc16fe8af5997d68c55cafc95e5d1" or
        hash.sha256(0, filesize) == "91f8fc7a3290611e28a35a403fd815554d9d856006cc2ee91ccdb64057ae53b0" or
        hash.sha256(0, filesize) == "a82e496b7b5279cb6b93393ec167dd3f50aff1557366784b25f9e51cb23689d9"
}