Gunra Ransomware - SHA256 Keystore Creation

Ethan Andrews@eandrews

•updated Feb 27, 2026•4•0•34

Detects the creation of files with a 64-character hexadecimal filename followed by a '.keystore' extension. This is a unique artifact of the Gunra ransomware's 'separate keystore' mode used for storing encryption keys.