{"id":10423,"date":"2025-07-28T12:31:16","date_gmt":"2025-07-28T05:31:16","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=10423"},"modified":"2026-02-05T12:31:23","modified_gmt":"2026-02-05T05:31:23","slug":"gunra-ransomware-ma-hoa-da-luong-xoa-sach-ban-sao-luu-tren-windows","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/2025\/07\/28\/gunra-ransomware-ma-hoa-da-luong-xoa-sach-ban-sao-luu-tren-windows\/","title":{"rendered":"Gunra ransomware: M\u00e3 h\u00f3a \u0111a lu\u1ed3ng, x\u00f3a s\u1ea1ch b\u1ea3n sao l\u01b0u tr\u00ean Windows"},"content":{"rendered":"<p><b>M\u1ed9t bi\u1ebfn th\u1ec3 ransomware m\u1edbi c\u00f3 t\u00ean Gunra v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n \u0111ang nh\u1eafm v\u00e0o h\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows. M\u00e3 \u0111\u1ed9c n\u00e0y s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt m\u00e3 h\u00f3a d\u1eef li\u1ec7u \u0111a lu\u1ed3ng k\u1ebft h\u1ee3p v\u1edbi h\u00e0nh vi x\u00f3a b\u1ea3n sao l\u01b0u h\u1ec7 th\u1ed1ng nh\u1eb1m ng\u0103n ch\u1eb7n n\u1ea1n nh\u00e2n kh\u00f4i ph\u1ee5c d\u1eef li\u1ec7u. Gunra \u0111\u01b0\u1ee3c ghi nh\u1eadn l\u1ea7n \u0111\u1ea7u v\u00e0o th\u00e1ng 04\/2025 v\u00e0 nhanh ch\u00f3ng thu h\u00fat s\u1ef1 ch\u00fa \u00fd do mang d\u1ea5u \u1ea5n k\u1ef9 thu\u1eadt c\u1ee7a nh\u00f3m Conti &#8211; nh\u00f3m ransomware t\u1eebng g\u00e2y ra nhi\u1ec1u cu\u1ed9c t\u1ea5n c\u00f4ng quy m\u00f4 l\u1edbn tr\u01b0\u1edbc khi b\u1ecb r\u00f2 r\u1ec9 m\u00e3 ngu\u1ed3n n\u1ed9i b\u1ed9.<\/b><\/p>\n<div style=\"text-align: center\">\n<div class=\"bbImageWrapper  js-lbImage\" title=\"Gunra.png\" data-src=\"https:\/\/whitehat.vn\/attachments\/gunra-png.17375\/\" data-lb-sidebar-href=\"\" data-lb-caption-extra-html=\"\" data-single-image=\"1\"><img fetchpriority=\"high\" decoding=\"async\" class=\"bbImage\" title=\"Gunra.png\" src=\"https:\/\/whitehat.vn\/attachments\/gunra-png.17375\/\" alt=\"Gunra.png\" width=\"700\" height=\"390\" data-url=\"\" data-zoom-target=\"1\" \/><\/div>\n<\/div>\n<h3>T\u1ed1i \u01b0u h\u00f3a t\u1ed1c \u0111\u1ed9 m\u00e3 h\u00f3a v\u00e0 l\u1ef1a ch\u1ecdn m\u1ee5c ti\u00eau c\u00f3 ch\u1ee7 \u0111\u00edch\u200b<\/h3>\n<p>Ngay khi \u0111\u01b0\u1ee3c th\u1ef1c thi, Gunra t\u1ef1 \u0111\u1ed9ng t\u1ea1o s\u1ed1 lu\u1ed3ng x\u1eed l\u00fd t\u01b0\u01a1ng \u1ee9ng v\u1edbi s\u1ed1 l\u00f5i logic c\u1ee7a CPU \u0111\u1ec3 \u0111\u1ea9y nhanh ti\u1ebfn tr\u00ecnh m\u00e3 h\u00f3a. M\u1ed7i lu\u1ed3ng sinh kh\u00f3a phi\u00ean ri\u00eang b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng kh\u00f3a RSA c\u00f4ng khai t\u00edch h\u1ee3p s\u1eb5n trong m\u00e3 nh\u1ecb ph\u00e2n. T\u1eeb \u0111\u00f3, ransomware t\u1ea1o kh\u00f3a ChaCha20 \u0111\u1ec3 th\u1ef1c hi\u1ec7n m\u00e3 h\u00f3a d\u1eef li\u1ec7u v\u1edbi hi\u1ec7u su\u1ea5t t\u1ed1i \u0111a. Vi\u1ec7c t\u1eadn d\u1ee5ng ki\u1ebfn tr\u00fac CPU gi\u00fap Gunra ho\u00e0n t\u1ea5t vi\u1ec7c m\u00e3 h\u00f3a nhanh h\u01a1n \u0111\u00e1ng k\u1ec3 so v\u1edbi c\u00e1c ransomware ho\u1ea1t \u0111\u1ed9ng \u0111\u01a1n lu\u1ed3ng truy\u1ec1n th\u1ed1ng, r\u00fat ng\u1eafn th\u1eddi gian ph\u00e1t hi\u1ec7n v\u00e0 ph\u1ea3n \u1ee9ng t\u1eeb ph\u00eda ng\u01b0\u1eddi d\u00f9ng<\/p>\n<div style=\"text-align: center\">\n<div class=\"bbImageWrapper  js-lbImage\" title=\"1753677748769.png\" data-src=\"https:\/\/whitehat.vn\/attachments\/1753677748769-png.17378\/\" data-lb-sidebar-href=\"\" data-lb-caption-extra-html=\"\" data-single-image=\"1\"><img decoding=\"async\" class=\"bbImage\" title=\"1753677748769.png\" src=\"https:\/\/whitehat.vn\/attachments\/1753677748769-png.17378\/\" alt=\"1753677748769.png\" width=\"1141\" height=\"700\" data-url=\"\" data-zoom-target=\"1\" \/><\/div>\n<\/div>\n<p>Tuy nh\u1eafm v\u00e0o d\u1eef li\u1ec7u ng\u01b0\u1eddi d\u00f9ng, Gunra tr\u00e1nh m\u00e3 h\u00f3a c\u00e1c th\u01b0 m\u1ee5c quan tr\u1ecdng nh\u01b0 Windows, Boot, System Volume Information. N\u00f3 c\u0169ng lo\u1ea1i tr\u1eeb c\u00e1c t\u1eadp tin \u0111\u1ecbnh d\u1ea1ng .exe, .dll, .lnk v\u00e0 c\u1ea3 nh\u1eefng t\u1ec7p \u0111\u00e3 b\u1ecb m\u00e3 h\u00f3a v\u1edbi ph\u1ea7n m\u1edf r\u1ed9ng .ENCRT. \u0110\u1eb7c bi\u1ec7t, Gunra kh\u00f4ng m\u00e3 h\u00f3a th\u00f4ng \u0111i\u1ec7p t\u1ed1ng ti\u1ec1n (R3ADM3.txt) v\u00e0 t\u1ec7p log c\u00f3 t\u00ean CONTI_LOG.txt \u2013 chi ti\u1ebft g\u1ee3i nh\u1eafc v\u1ec1 m\u1ed1i li\u00ean h\u1ec7 k\u1ef9 thu\u1eadt v\u1edbi ransomware kh\u00e9t ti\u1ebfng Conti.<\/p>\n<div style=\"text-align: center\">\n<div class=\"bbImageWrapper  js-lbImage\" title=\"1753677577321.png\" data-src=\"https:\/\/whitehat.vn\/attachments\/1753677577321-png.17377\/\" data-lb-sidebar-href=\"\" data-lb-caption-extra-html=\"\" data-single-image=\"1\"><img decoding=\"async\" class=\"bbImage\" title=\"1753677577321.png\" src=\"https:\/\/whitehat.vn\/attachments\/1753677577321-png.17377\/\" alt=\"1753677577321.png\" width=\"800\" height=\"609\" data-url=\"\" data-zoom-target=\"1\" \/><\/div>\n<p><i>Ghi ch\u00fa ti\u1ec1n chu\u1ed9c<\/i>\u200b<\/div>\n<h3>X\u00f3a s\u1ea1ch sao l\u01b0u, kh\u00f3a \u0111\u01b0\u1eddng ph\u1ee5c h\u1ed3i\u200b<\/h3>\n<p>Sau khi m\u00e3 h\u00f3a d\u1eef li\u1ec7u, Gunra th\u1ef1c hi\u1ec7n b\u01b0\u1edbc ti\u1ebfp theo \u0111\u1ec3 kh\u00f3a ch\u1eb7t c\u01a1 h\u1ed9i kh\u00f4i ph\u1ee5c. Ransomware n\u00e0y x\u00f3a c\u00e1c b\u1ea3n sao l\u01b0u Volume Shadow Copy c\u1ee7a h\u1ec7 th\u1ed1ng. Thay v\u00ec d\u00f9ng l\u1ec7nh ph\u1ed5 bi\u1ebfn nh\u01b0 vssadmin, n\u00f3 g\u1ecdi tr\u1ef1c ti\u1ebfp Windows Management Instrumentation Command-line (WMIC) th\u00f4ng qua cmd.exe, cho th\u1ea5y m\u1ee9c \u0111\u1ed9 ki\u1ec3m so\u00e1t s\u00e2u \u0111\u1ed1i v\u1edbi m\u00e1y b\u1ecb nhi\u1ec5m.<\/p>\n<div class=\"bbCodeBlock bbCodeBlock--screenLimited bbCodeBlock--code\">\n<div class=\"bbCodeBlock-title\">M\u00e3:<\/div>\n<div class=\"bbCodeBlock-content\" dir=\"ltr\">\n<pre class=\"bbCodeCode\" dir=\"ltr\" data-xf-init=\"code-block\" data-lang=\"\"><code>cmd.exe \/c C:\\Windows\\System32\\wbem\\WMIC.exe shadowcopy where \"ID={GUID}\" delete<\/code><\/pre>\n<\/div>\n<\/div>\n<p>H\u00e0nh \u0111\u1ed9ng n\u00e0y v\u00f4 hi\u1ec7u h\u00f3a ho\u00e0n to\u00e0n Volume Shadow Copy, c\u01a1 ch\u1ebf sao l\u01b0u n\u1ed9i b\u1ed9 quan tr\u1ecdng nh\u1ea5t c\u1ee7a Windows, th\u01b0\u1eddng \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 ph\u1ee5c h\u1ed3i h\u1ec7 th\u1ed1ng khi g\u1eb7p s\u1ef1 c\u1ed1 nh\u01b0 nhi\u1ec5m ransomware. V\u1edbi t\u1eebng l\u1ec7nh g\u1ecdi tr\u1ef1c ti\u1ebfp WMIC, Gunra \u0111\u1ea3m b\u1ea3o kh\u00f4ng \u0111\u1ec3 l\u1ea1i b\u1ea5t k\u1ef3 con \u0111\u01b0\u1eddng kh\u00f4i ph\u1ee5c n\u00e0o kh\u1ea3 thi cho n\u1ea1n nh\u00e2n. Khi kh\u00f4ng c\u00f2n l\u1ef1a ch\u1ecdn kh\u00f4i ph\u1ee5c n\u00e0o kh\u1ea3 thi, n\u1ea1n nh\u00e2n d\u1ec5 b\u1ecb \u0111\u1ea9y v\u00e0o th\u1ebf ph\u1ea3i c\u00e2n nh\u1eafc nghi\u00eam t\u00fac vi\u1ec7c tr\u1ea3 ti\u1ec1n chu\u1ed9c.<\/p>\n<h3>Chi\u1ebfn thu\u1eadt t\u00e2m l\u00fd v\u00e0 ki\u1ec3m so\u00e1t v\u00f9ng m\u00e3 h\u00f3a\u200b<\/h3>\n<p>Gunra kh\u00f4ng ch\u1ec9 m\u00e3 h\u00f3a d\u1eef li\u1ec7u m\u00e0 c\u00f2n \u0111\u00e1nh v\u00e0o y\u1ebfu t\u1ed1 t\u00e2m l\u00fd. Sau khi t\u1ea5n c\u00f4ng, n\u1ea1n nh\u00e2n \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u truy c\u1eadp m\u1ed9t trang web do nh\u00f3m t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t \u0111\u1ec3 nh\u1eadn h\u01b0\u1edbng d\u1eabn thanh to\u00e1n. K\u00e8m theo \u0111\u00f3 l\u00e0 c\u1ea3nh b\u00e1o ch\u1ec9 c\u00f3 n\u0103m ng\u00e0y \u0111\u1ec3 b\u1eaft \u0111\u1ea7u \u0111\u00e0m ph\u00e1n. T\u1ed1i h\u1eadu th\u01b0 ng\u1eafn h\u1ea1n n\u00e0y g\u00e2y \u00e1p l\u1ef1c l\u1edbn, bu\u1ed9c n\u1ea1n nh\u00e2n ph\u1ea3i ra quy\u1ebft \u0111\u1ecbnh trong \u0111i\u1ec1u ki\u1ec7n c\u0103ng th\u1eb3ng v\u00e0 kh\u00f4ng ch\u1eafc ch\u1eafn. \u0110\u00e2y l\u00e0 k\u1ef9 thu\u1eadt quen thu\u1ed9c t\u1eebng \u0111\u01b0\u1ee3c Conti, LockBit v\u00e0 BlackCat s\u1eed d\u1ee5ng \u0111\u1ec3 thao t\u00fang t\u00e2m l\u00fd c\u00e1c b\u1ed9 ph\u1eadn IT kh\u00f4ng chuy\u00ean s\u00e2u trong t\u00ecnh hu\u1ed1ng kh\u1ea9n c\u1ea5p, nh\u1eb1m nhanh ch\u00f3ng \u00e9p h\u1ecd th\u1ef1c hi\u1ec7n thanh to\u00e1n tr\u01b0\u1edbc khi c\u00f3 th\u1ec3 ti\u1ebfp c\u1eadn \u0111\u1ed9i ph\u1ea3n \u1ee9ng s\u1ef1 c\u1ed1 chuy\u00ean nghi\u1ec7p.<\/p>\n<p>Kh\u00f4ng d\u1eebng l\u1ea1i \u1edf \u0111\u00f3, Gunra c\u00f2n tri\u1ec3n khai m\u00e3 h\u00f3a c\u00f3 ki\u1ec3m so\u00e1t \u0111\u1ec3 t\u1ed1i \u01b0u kh\u1ea3 n\u0103ng chu\u1ed9c ti\u1ec1n. N\u1ebfu ph\u00e1t hi\u1ec7n \u1ed5 \u0111\u0129a h\u1ec7 th\u1ed1ng l\u00e0 \u1ed5 C, ransomware ch\u1ec9 ho\u1ea1t \u0111\u1ed9ng trong th\u01b0 m\u1ee5c C:\\Users. Chi\u1ebfn thu\u1eadt n\u00e0y gi\u1eef cho h\u1ec7 \u0111i\u1ec1u h\u00e0nh v\u1eabn c\u00f3 th\u1ec3 kh\u1edfi \u0111\u1ed9ng v\u00e0 v\u1eadn h\u00e0nh b\u00ecnh th\u01b0\u1eddng, qua \u0111\u00f3 \u0111\u1ea3m b\u1ea3o n\u1ea1n nh\u00e2n v\u1eabn c\u00f3 th\u1ec3 \u0111\u1ecdc \u0111\u01b0\u1ee3c th\u00f4ng b\u00e1o \u0111\u00f2i ti\u1ec1n v\u00e0 th\u1ef1c hi\u1ec7n li\u00ean l\u1ea1c v\u1edbi k\u1ebb t\u1ea5n c\u00f4ng.<\/p>\n<h3>C\u1ea3nh b\u00e1o v\u00e0 bi\u1ec7n ph\u00e1p ph\u00f2ng th\u1ee7\u200b<\/h3>\n<p>Gunra cho th\u1ea5y xu h\u01b0\u1edbng m\u1edbi trong ho\u1ea1t \u0111\u1ed9ng ransomware-as-a-service (RaaS) v\u00e0 s\u1ef1 b\u00f9ng n\u1ed5 c\u1ee7a c\u00e1c Dedicated Leak Sites trong n\u1eeda \u0111\u1ea7u 2025. C\u00e1c t\u1ed5 ch\u1ee9c \u0111\u01b0\u1ee3c khuy\u1ebfn c\u00e1o:<\/p>\n<ul>\n<li data-xf-list-type=\"ul\">Duy tr\u00ec sao l\u01b0u \u0111\u1ecbnh k\u1ef3, ph\u00e2n t\u00e1ch v\u1eadt l\u00fd ho\u1eb7c \u0111\u1ecba l\u00fd<\/li>\n<li data-xf-list-type=\"ul\">Gi\u1edbi h\u1ea1n quy\u1ec1n truy c\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng sao l\u01b0u<\/li>\n<li data-xf-list-type=\"ul\">Di\u1ec5n t\u1eadp ph\u1ee5c h\u1ed3i d\u1eef li\u1ec7u th\u01b0\u1eddng xuy\u00ean<\/li>\n<li data-xf-list-type=\"ul\">C\u1eadp nh\u1eadt h\u1ec7 th\u1ed1ng b\u1ea3o m\u1eadt v\u00e0 endpoint<\/li>\n<li data-xf-list-type=\"ul\">Duy tr\u00ec v\u1ec7 sinh an ninh trong email v\u00e0 m\u1ea1ng n\u1ed9i b\u1ed9<\/li>\n<\/ul>\n<p>D\u01b0\u1edbi \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ed1 ch\u1ec9 d\u1ea5u nh\u1eadn di\u1ec7n (IOC) m\u1eabu Gunra \u0111\u00e3 ghi nh\u1eadn:<\/p>\n<div class=\"bbTable\">\n<table style=\"width: 100%\">\n<tbody>\n<tr>\n<td>\n<div style=\"text-align: center\"><b>MD5 Hash<\/b>\u200b<\/div>\n<\/td>\n<td>\n<div style=\"text-align: center\"><b>M\u00f4 t\u1ea3<\/b>\u200b<\/div>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<div style=\"text-align: left\">0339269cef32f7af77ce9700ce7bf2e2\u200b<\/div>\n<\/td>\n<td>\n<div style=\"text-align: center\">M\u1eabu Gunra\u200b<\/div>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<div style=\"text-align: left\">3178501218c7edaef82b73ae83cb4d91\u200b<\/div>\n<\/td>\n<td>\n<div style=\"text-align: center\">\nM\u1eabu Gunra\u200b<\/div>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<div style=\"text-align: left\">7dd26568049fac1b87f676ecfaac9ba0\u200b<\/div>\n<\/td>\n<td>\n<div style=\"text-align: center\">M\u1eabu Gunra\u200b<\/div>\n<\/td>\n<\/tr>\n<tr>\n<td>92e11df03725e29d963d44508d41a8dd<\/td>\n<td>\n<div style=\"text-align: center\">M\u1eabu Gunra\u200b<\/div>\n<\/td>\n<\/tr>\n<tr>\n<td>9a7c0adedc4c68760e49274700218507<\/td>\n<td>\n<div style=\"text-align: center\">M\u1eabu Gunra\u200b<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>Gunra kh\u00f4ng ch\u1ec9 l\u00e0 m\u1ed9t bi\u1ebfn th\u1ec3 ransomware. N\u00f3 \u0111\u1ea1i di\u1ec7n cho xu th\u1ebf t\u1ea5n c\u00f4ng m\u1edbi, n\u01a1i m\u00e3 \u0111\u1ed9c v\u1eeba t\u0103ng t\u1ed1c m\u00e3 h\u00f3a v\u1eeba ph\u00e1 h\u1ee7y m\u1ecdi c\u01a1 h\u1ed9i kh\u00f4i ph\u1ee5c. Trong b\u1ed1i c\u1ea3nh \u0111\u00f3, n\u0103ng l\u1ef1c ph\u00f2ng th\u1ee7 th\u00f4i l\u00e0 ch\u01b0a \u0111\u1ee7, vi\u1ec7c ph\u1ee5c h\u1ed3i d\u1eef li\u1ec7u v\u00e0 duy tr\u00ec ho\u1ea1t \u0111\u1ed9ng sau t\u1ea5n c\u00f4ng ph\u1ea3i tr\u1edf th\u00e0nh n\u0103ng l\u1ef1c b\u1eaft bu\u1ed9c trong m\u1ecdi k\u1ebf ho\u1ea1ch \u1ee9ng ph\u00f3.<\/p>\n<div style=\"text-align: right\"><b><i>Theo Cyber Press<\/i><\/b>\u200b<\/div>\n<div style=\"text-align: right;margin-top: 16px\"><i>Theo: <a href=\"https:\/\/whitehat.vn\/threads\/gunra-ransomware-ma-hoa-da-luong-xoa-sach-ban-sao-luu-tren-windows.18607\/\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/whitehat.vn\/threads\/gunra-ransomware-ma-hoa-da-luong-xoa-sach-ban-sao-luu-tren-windows.18607\/<\/a><\/i><\/div>\n","protected":false},"excerpt":{"rendered":"<p>M\u1ed9t bi\u1ebfn th\u1ec3 ransomware m\u1edbi c\u00f3 t\u00ean Gunra v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n \u0111ang nh\u1eafm v\u00e0o h\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows. M\u00e3 \u0111\u1ed9c n\u00e0y s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt m\u00e3 h\u00f3a d\u1eef li\u1ec7u \u0111a lu\u1ed3ng k\u1ebft h\u1ee3p v\u1edbi h\u00e0nh vi x\u00f3a b\u1ea3n sao l\u01b0u h\u1ec7 th\u1ed1ng nh\u1eb1m ng\u0103n ch\u1eb7n n\u1ea1n nh\u00e2n kh\u00f4i ph\u1ee5c d\u1eef li\u1ec7u. Gunra \u0111\u01b0\u1ee3c ghi [&hellip;]<\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"class_list":["post-10423","post","type-post","status-publish","format-standard","hentry","category-tin-tuc-cua-vien"],"_links":{"self":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10423","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/comments?post=10423"}],"version-history":[{"count":0,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10423\/revisions"}],"wp:attachment":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/media?parent=10423"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/categories?post=10423"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/tags?post=10423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}