78ResearchLab analyzed Gunra ransomware in connection with the July 2025 SGI Seoul Guarantee incident and describes it as Conti-derived ransomware that commonly reaches victim servers through VPN, SSH, and RDP brute force or vulnerabilities. The sample dynamically resolves Windows APIs by obtaining kernel32.dll through the PEB and walking the IAT, reducing exposed imports while also preventing duplicate execution with the mutex kjsidugiaadf99439. Gunra uses CPU-based multithreaded encryption, generates ChaCha20 keys with CryptGenRandom, protects them with RSA-2048, encrypts up to the first 5 MB of files, and changes encrypted files to the .ECRT extension. It drops R3ADM3.txt ransom notes, excludes selected system folders and executable file types, and removes Windows shadow copies to obstruct recovery. The report provides MD5 and SHA256 hashes for the analyzed Microsoft Visual C++ sample.