SunCrypt

Aliases: Sun, Suncrypt

First seen
2019-10-01 00:00:00
Malware type
ransomware
Family
Malware family
Profile updated
2026-07-07 12:57:18

Targeted industries: financial-services healthcare-and-pharmaceutical retail-and-hospitality technology-and-telecommunications

Context

SunCrypt ransomware was discovered in October 2019 and in August 2020 it was added to Maze ransomware’s cartel. It also follows some of Maze’s tactics, techniques, and procedures. SunCrypt is launched and installed using an obfuscated PowerShell script. Infected email attachments (macros), torrent websites, malicious ads act as carriers for this ransomware.

Detection coverage

  • 4 YARA rules

Detection rules

  • TRELLIX_ARC_RANSOM_Suncrypt (yara-rule)
  • TRELLIX_ARC_RANSOM_Suncrypt_Decryptor (yara-rule)
  • DITEKSHEN_MALWARE_Win_Suncrypt (yara-rule)
  • MALPEDIA_Win_Suncrypt_Auto (yara-rule)

Reports & references

  • analyst1.com — Ransom Mafia Analysis Of The World%E2%80%99S First Ransomware Cartel (report)
  • CrowdStrike — Report2021Gtr (report)
  • analyst1.com — Ransom Mafia Analysis Of The Worlds First Ransomware Cartel (report)
  • docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
  • ke-la.com — To Attack Or Not To Attack Targeting The Healthcare Sector In The Underground Ecosystem (report)
  • public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)
  • accenture.com — Evolving Danger Ransomware Extortion (report)
  • coveware.com — Ransomware Attack Vectors Shift As New Software Vulnerability Exploits Abound (report)
  • hornetsecurity.com — Leakware Ransomware Hybrid Attacks (report)
  • pwc.co.uk — What Is Behind Ransomware Attacks Increase (report)
  • Trend Micro — Gootkit Loaders Updated Tactics And Fileless Delivery Of Cobalt Strike (report)
  • blog.chainalysis.com — Ransomware Connections Maze Egregor Suncrypt Doppelpaymer (report)
  • intezer.com — When Viruses Mutate Did Suncrypt Ransomware Evolve From Qnapcrypt (report)
  • acronis.com — Suncrypt Adopts Attacking Techniques Netwalker And Maze Ransomware (report)
  • bleepingcomputer.com — Suncrypt Ransomware Sheds Light On The Maze Ransomware Cartel (report)
  • securityboulevard.com — The Curious Case Of Suncrypt (report)
  • tetradefense.com — Cause And Effect Suncrypt Ransomware Analysis (report)
  • blog.minerva-labs.com — Suncrypt Ransomware Gains New Abilities In 2022 (report)
  • cdn.pathfactory.com — 0Dd521F8 Aa64 4517 834E Bc852E9Ab95D (report)
  • medium.com — Diving Into The Sun Suncrypt A New Neighbour In The Ransomware Mafia D89010C9Df83 (report)
  • medium.com — Case Analysis Of Suncrypt Ransomware Negotiation And Bitcoin Transaction 43A2194Ac0Bc (report)
  • medium.com — W4 July En Story Of The Week Ransomware On The Darkweb C61965D0386A (report)
  • pcsxcetrasupport3.wordpress.com — Suncrypt Powershell Obfuscation Shellcode And More Yara (report)
  • bleepingcomputer.com — Suncrypt Ransomware Is Still Alive And Kicking In 2022 (report)
  • bleepingcomputer.com — The Week In Ransomware April 1St 2022 I Can Fight With A Keyboard (report)

External references