AA26-222A #StopRansomware: Gunra Ransomware Indicators This STIX file provides indicators of compromise (IOCs) associated with malicious activity reported in CISA CSA, AA26-222A #StopRansomware: Gunra Ransomware. //node() | //@* CISA CISA CISA 2026-08-07T00:00:00 Domain Watchlist datapub.news Domain Watchlist nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onion IP Watchlist 123.246.37.108 IP Watchlist 67.43.53.10 IP Watchlist 182.204.39.118 IP Watchlist 123.244.187.144 IP Watchlist 182.204.16.112 IP Watchlist 182.204.21.240 IP Watchlist 123.184.143.105 IP Watchlist 211.21.210.181 IP Watchlist 86.54.28.216 IP Watchlist 23.239.119.6 IP Watchlist 23.239.119.5 IP Watchlist 23.239.119.4 IP Watchlist 23.239.119.3 IP Watchlist 23.239.119.2 Malicious E-mail 6449a3c1e612168526@proton.me Malicious E-mail ilovemycubscout@gmail.com Malicious E-mail 4569f6322bc3b22e9@proton.me Malicious E-mail a00f105546345756@proton.me File Hash Watchlist main.exe SHA256 834EFE9B392C6C000877EA5613A079445AFFC16FE8AF5997D68C55CAFC95E5D1 File Hash Watchlist main.exe SHA256 2DC70A12D158D437E45A55B1D52F3D61C6082A1E1667573302BA3B62813E2751 Domain Watchlist lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion IP Watchlist 70.36.99.82 IP Watchlist 103.125.234.14 IP Watchlist 91.201.66.146 File Hash Watchlist cryptor.exe SHA256 91F8FC7A3290611E28A35A403FD815554D9D856006CC2EE91CCDB64057AE53B0 File Hash Watchlist msmp.exe MD5 7DD26568049FAC1B87F676ECFAAC9BA0 SHA1 BB79502D301BA77745B7DBC5DF4269FC7B074CDA SHA256 A82E496B7B5279CB6B93393EC167DD3F50AFF1557366784B25F9E51CB23689D9 Domain Watchlist gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onion Credential Access / Modify Authentication Process: Multi-Factor Authentication [T1556.006] (ENT) Exfiltration / Exfiltration Over Web Service [T1567] (ENT) Impact / Financial Theft [T1657] (ENT) Persistence / Account Manipulation [T1098] (ENT) Defense Evasion / Indicator Removal: Clear Command History [T1070.003] (ENT) Credential Access / OS Credential Dumping: NTDS [T1003.003] (ENT) Execution / Windows Management Instrumentation [T1047] (ENT) Impact / Inhibit System Recovery [T1490] (ENT) Command and Control / Ingress Tool Transfer [T1105] (ENT) Collection / Email Collection [T1114] (ENT) Collection / Data from Cloud Storage [T1530] (ENT) Collection / Data from Local System [T1005] (ENT) Exfiltration / Exfiltration Over Alternative Protocol [T1048] (ENT) Lateral Movement / Remote Services: Remote Desktop Protocol [T1021.001] (ENT) Privilege Escalation / Valid Accounts: Domain Accounts [T1078.002] (ENT) Credential Access / Credentials from Password Stores [T1555] (ENT) Defense Evasion / Use Alternate Authentication Material: Pass the Ticket [T1550.003] (ENT) Credential Access / Steal Web Session Cookie [T1539] (ENT) Persistence / External Remote Services [T1133] (ENT) Discovery / File and Directory Discovery [T1083] (ENT) Impact / Data Encrypted for Impact [T1486] (ENT) Collection [TA0009] (ENT) Execution / Command and Scripting Interpreter: Windows Command Shell [T1059.003] (ENT) Execution / Native API [T1106] (ENT) Credential Access / OS Credential Dumping [T1003] (ENT) Defense Evasion / Debugger Evasion [T1622] (ENT) Discovery / System Network Connections Discovery [T1049] (ENT) Initial Access / Exploit Public-Facing Application [T1190] (ENT) Privilege Escalation / Valid Accounts: Default Accounts [T1078.001] (ENT) Collection / Archive Collected Data [T1560] (ENT) Credential Access / Network Sniffing [T1040] (ENT) Command and Control / Protocol Tunneling [T1572] (ENT) Defense Evasion / Use Alternate Authentication Material: Pass the Hash [T1550.002] (ENT) Lateral Movement / Remote Services: SMB/Windows Admin Shares [T1021.002] (ENT)