{
    "type": "bundle",
    "id": "bundle--899ecff2-225b-423e-aadc-3a63094e118f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--48edf75c-7cd8-480a-8950-deb15067ea29",
            "created": "2026-04-13T05:27:30.708162Z",
            "modified": "2026-04-22T01:03:40.519059Z",
            "name": "BreakGlassIntelligence",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7223bd3a-78b5-430c-93dd-48afdadd9c9d",
            "value": "testexampleabcdefghijklmnop.onion"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--aa94fdcc-6893-44fe-9c4b-83f16f372973",
            "created": "2026-07-30T10:57:24.050328Z",
            "modified": "2026-07-30T10:57:24.050328Z",
            "name": "YARA Rule",
            "pattern": "rule Gunra_ELF_ChaCha20_PRNG_Weakness {\nmeta:\ndescription = \"Detects Gunra ransomware Linux ELF variant with weak PRNG\"\nauthor = \"Breakglass Intelligence\"\ndate = \"2026-03-09\"\ntlp = \"TLP:CLEAR\"\nseverity = \"CRITICAL\"\nreference = \"https://intel.breakglass.tech\"\nstrings:\n$chacha_const1 = \"expand 32-byte k\" ascii\n$lcg_constant = { 6D 4E C6 41 }\n$ransom_note = \"R3ADM3.txt\" ascii\n$extension = \".GNRA\" ascii\n$magic = \"GNRAH\" ascii\n$keystore = \".keystore\" ascii\n$encrt_magic = \"ENCRT\" ascii\ncondition:\nuint32(0) == 0x464C457F and\n$chacha_const1 and\n$lcg_constant and\n2 of ($ransom_note, $extension, $magic, $keystore, $encrt_magic)\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-12T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--98903d2e-e3d6-40dd-9684-5e3c44c76a0d",
            "created": "2026-07-30T10:57:24.050517Z",
            "modified": "2026-07-30T10:57:24.050517Z",
            "name": "YARA Rule",
            "pattern": "rule Gunra_ELF_Builder_Pattern {\r\nmeta:\r\ndescription = \"Detects Gunra ELF binaries by build naming and structural patterns\"\r\nauthor = \"Breakglass Intelligence\"\r\ndate = \"2026-03-09\"\r\ntlp = \"TLP:CLEAR\"\r\nseverity = \"HIGH\"\r\nstrings:\r\n$note_content = \"Your data has been encrypted\" ascii\r\n$tor_instruction = \"Please download Tor Browser\" ascii\r\n$contact_url = \".onion\" ascii\r\n$client_id = \"Client ID:\" ascii\r\n$password = \"Initial password:\" ascii\r\n$excluded1 = \"/proc\" ascii\r\n$excluded2 = \"/boot\" ascii\r\n$excluded3 = \"/sbin\" ascii\r\ncondition:\r\nuint32(0) == 0x464C457F and\r\nfilesize < 100KB and\r\n2 of ($note_content, $tor_instruction, $contact_url) and\r\n($client_id or $password) and\r\n2 of ($excluded*)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-12T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--3c375567-8cf2-43f6-9cee-ff66722b6e7c",
            "created": "2026-07-30T10:57:24.050687Z",
            "modified": "2026-07-30T10:57:24.050687Z",
            "name": "YARA Rule",
            "pattern": "rule Gunra_ELF_ChaCha20_PRNG_Weakness {\r\nmeta:\r\ndescription = \"Detects Gunra ransomware Linux ELF variant with weak PRNG\"\r\nauthor = \"Breakglass Intelligence\"\r\ndate = \"2026-03-09\"\r\ntlp = \"TLP:CLEAR\"\r\nseverity = \"CRITICAL\"\r\nreference = \"https://intel.breakglass.tech\"\r\nstrings:\r\n$chacha_const1 = \"expand 32-byte k\" ascii\r\n$lcg_constant = { 6D 4E C6 41 } // 0x41C64E6D little-endian (musl rand LCG)\r\n$ransom_note = \"R3ADM3.txt\" ascii\r\n$extension = \".GNRA\" ascii\r\n$magic = \"GNRAH\" ascii\r\n$keystore = \".keystore\" ascii\r\n$encrt_magic = \"ENCRT\" ascii\r\ncondition:\r\nuint32(0) == 0x464C457F and // ELF magic\r\n$chacha_const1 and\r\n$lcg_constant and\r\n2 of ($ransom_note, $extension, $magic, $keystore, $encrt_magic)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-12T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--03def745-7fe6-4bd6-963d-ae08f12e89f0",
            "hashes": {
                "MD5": "4c0e74e9f94dff611226cd1619cb1e1d",
                "SHA-1": "a7703d68e4ae4ada31fd1fb01c4169d8da56e4b7",
                "SHA-256": "6d59bb6a9874b9b03ce6ab998def5b93f68dadedccad9b14433840c2c5c3a34e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ca4d7e28-a988-4dbf-bd33-5187b5c9bb65",
            "hashes": {
                "MD5": "186c77101c027a465b14cb4a74f8381e",
                "SHA-1": "6faef3ca4e9ad30d736cd3716e116e040955b322",
                "SHA-256": "75cb7eb79a5fa0d388547520c6c452c700d38659080be074d70395729a0b578e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d96ccda7-3c5a-429b-b229-e2d037c52477",
            "hashes": {
                "MD5": "b54edbcec7664fde548a7ba1fa8b3b78",
                "SHA-1": "075dcc323259d84297e3699768c0519cc4796868",
                "SHA-256": "eb46dfb4f15000a7d4af040b68e541251fd5716d2a77958b471a17ce2960416f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--23b721c7-b7c7-4842-acf3-2cb918d8901c",
            "hashes": {
                "MD5": "136e0bf4e5fe4d4249fe9570153a0b97",
                "SHA-1": "333b88066da20c147309a52b8db07379f7da9d6d",
                "SHA-256": "0909ecc86f8a89831c9c229de91b829aba6cb54685a2478f89cc04376b13488e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--619d5d0e-112c-4389-8ed0-94bb762393cd",
            "hashes": {
                "MD5": "182024fc6c5fe0b1b33fdd9c7c37e368",
                "SHA-1": "b75596415398073aa4c050cdc2f83861b8b90ee1",
                "SHA-256": "5677dfad26045e271272bc98be2fd24e2f6d13737850ab1d9857fd58de05e9f9"
            }
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--b7f337b3-6a72-42f1-aac3-edc49b4bcdee",
            "created_by_ref": "identity--48edf75c-7cd8-480a-8950-deb15067ea29",
            "created": "2026-07-30T10:57:24.057173Z",
            "modified": "2026-07-30T10:57:24.057173Z",
            "name": "Gunra Ransomware's Linux Variant Has a Fatal Flaw: time()-Seeded rand() Makes Encrypted Files Recoverable Without Paying",
            "published": "2026-03-12T00:00:00Z",
            "object_refs": [
                "identity--48edf75c-7cd8-480a-8950-deb15067ea29",
                "domain-name--7223bd3a-78b5-430c-93dd-48afdadd9c9d",
                "indicator--aa94fdcc-6893-44fe-9c4b-83f16f372973",
                "indicator--98903d2e-e3d6-40dd-9684-5e3c44c76a0d",
                "indicator--3c375567-8cf2-43f6-9cee-ff66722b6e7c",
                "file--03def745-7fe6-4bd6-963d-ae08f12e89f0",
                "file--ca4d7e28-a988-4dbf-bd33-5187b5c9bb65",
                "file--d96ccda7-3c5a-429b-b229-e2d037c52477",
                "file--23b721c7-b7c7-4842-acf3-2cb918d8901c",
                "file--619d5d0e-112c-4389-8ed0-94bb762393cd"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://intel.breakglass.tech/post/gunra-ransomware-s-linux-variant-has-a-fatal-flaw-time-seeded-rand-makes-encrypted-files-recoverable-without-paying"
                }
            ]
        }
    ]
}