Analysis of Gunra Ransomware Using Vulnerable Random Number Generation Function (Distributed for Linux Environments in ELF Format)

This report analyzes the Gunra ransomware (active April 2025), detailing its command-line options, per-file and disk encryption behavior, and differences between ELF (Linux) and EXE (Windows) variants. The ELF variant uses ChaCha20 with a cryptographically weak rand()-based key/nonce generator that makes brute-force decryption feasible, while the EXE variant uses ChaCha8 with CryptGenRandom(), rendering decryption infeasible; the report includes IOCs (MD5) and AhnLab detection names.