Curator
Aliases: Ever101, SunnyDay
- First seen
- 2020-09-15 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 14:55:48
Targeted industries: healthcare-and-pharmaceutical financial-services government-and-public-sector
Context
Curator, also known as Ever101 or SunnyDay, is a ransomware family targeting various industries, notably healthcare, financial services, and the public sector. This malware encrypts files on infected systems and demands a ransom for decryption, often distributed through phishing campaigns and exploit kits.
Detection coverage
- 2 YARA rules
Detection rules
- MALPEDIA_Win_Curator_Auto (yara-rule)
- SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Chily_Jan23_1 (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Curator (report)
- shared-public-reports.s3.eu-west-1.amazonaws.com — Secrets Behind The Mysterious Ever101 Ransomware (report)
- seguranca-informatica.pt — Analysis Of The Sunnyday Ransomware (report)
- sentinelone.com — Custom Branded Ransomware The Vice Society Group And The Threat Of Outsourced Development (report)