SYMBOLCOMMON_NAMEaka. SYNONYMS
win.suncrypt (Back to overview)

SunCrypt

VTCollection    

According to PCrisk, Suncrypt ransomware prevents victims from accessing files by encryption. It also renames all encrypted files and creates a ransom message. It renames encrypted files by appending a string of random characters as the new extension.

References
2022-07-27 ⋅ Trend Micro ⋅ Buddy Tancio, Jed Valderama
Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike
Cobalt Strike GootKit Kronos REvil SunCrypt
2022-04-12 ⋅ LIFARS ⋅ Vlad Pasca
A Detailed Analysis of The SunCrypt Ransomware
SunCrypt
2022-04-01 ⋅ Bleeping Computer ⋅ Lawrence Abrams
The Week in Ransomware - April 1st 2022 - 'I can fight with a keyboard'
Hive Dharma LockBit STOP SunCrypt
2022-03-28 ⋅ Bleeping Computer ⋅ Bill Toulas
SunCrypt ransomware is still alive and kicking in 2022
SunCrypt
2022-03-28 ⋅ Minerva Labs ⋅ Natalie Zargarov
SunCrypt Ransomware Gains New Capabilities in 2022
SunCrypt
2021-09-09 ⋅ Medium s2wlab ⋅ S2W TALON
Case Analysis of Suncrypt Ransomware Negotiation and Bitcoin Transaction
SunCrypt
2021-07-22 ⋅ S2W LAB Inc. ⋅ Denise Dasom Kim, Jungyeon Lim, Sujin Lim, Yeonghyeon Jeong
W4 July | EN | Story of the week: Ransomware on the Darkweb
LockBit SunCrypt
2021-05-10 ⋅ DarkTracer ⋅ DarkTracer
Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb
RansomEXX Avaddon Babuk Clop Conti Cuba DarkSide DoppelPaymer Egregor Hades LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker Nefilim Nemty Pay2Key PwndLocker RagnarLocker Ragnarok RansomEXX REvil Sekhmet SunCrypt ThunderX
2021-04-26 ⋅ CoveWare ⋅ CoveWare
Ransomware Attack Vectors Shift as New Software Vulnerability Exploits Abound
Avaddon Clop Conti DarkSide Egregor LockBit Mailto Phobos REvil Ryuk SunCrypt
2021-04-07 ⋅ ANALYST1 ⋅ Jon DiMaggio
Ransom Mafia Analysis of the World's First Ransomware Cartel
Conti Egregor LockBit Maze RagnarLocker Ryuk SunCrypt TA2101 VIKING SPIDER
2021-04-07 ⋅ ANALYST1 ⋅ Jon DiMaggio
Ransom Mafia - Analysis of the World's First Ransomware Cartel
Conti Egregor LockBit Maze RagnarLocker SunCrypt VIKING SPIDER
2021-03-28 ⋅ PC's Xcetra Support ⋅ David Ledbetter
SunCrypt, PowerShell obfuscation, shellcode and more yara
SunCrypt
2021-03-02 ⋅ Intezer ⋅ Joakim Kennedy
When Viruses Mutate: Did SunCrypt Ransomware Evolve from QNAPCrypt?
QNAPCrypt SunCrypt
2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-02-04 ⋅ Chainanalysis ⋅ Chainalysis Team
Blockchain Analysis Shows Connections Between Four of 2020’s Biggest Ransomware Strains
DoppelPaymer Egregor Maze SunCrypt
2020-12-16 ⋅ Accenture ⋅ Paul Mansfield
Tracking and combatting an evolving danger: Ransomware extortion
DarkSide Egregor Maze Nefilim RagnarLocker REvil Ryuk SunCrypt
2020-11-16 ⋅ Intel 471 ⋅ Intel 471
Ransomware-as-a-service: The pandemic within a pandemic
Avaddon Clop Conti DoppelPaymer Egregor Hakbit Mailto Maze Mespinoza RagnarLocker REvil Ryuk SunCrypt ThunderX
2020-11-12 ⋅ Medium Sapphirex00 ⋅ Sapphire
Diving into the Sun — SunCrypt: A new neighbour in the ransomware mafia
SunCrypt
2020-10-23 ⋅ Hornetsecurity ⋅ Hornetsecurity Security Lab
Leakware-Ransomware-Hybrid Attacks
Avaddon Clop Conti DarkSide DoppelPaymer Mailto Maze Mespinoza Nefilim RagnarLocker REvil Sekhmet SunCrypt
2020-10-08 ⋅ Tesorion ⋅ Gijs Rijnders
Shining a light on SunCrypt’s curious file encryption mechanism
SunCrypt
2020-10-01 ⋅ KELA ⋅ Victoria Kivilevich
To Attack or Not to Attack: Targeting the Healthcare Sector in the Underground Ecosystem
Conti DoppelPaymer Mailto Maze REvil Ryuk SunCrypt
2020-09-29 ⋅ PWC UK ⋅ Andy Auld
What's behind the increase in ransomware attacks this year?
DarkSide Avaddon Clop Conti DoppelPaymer Dridex Emotet FriedEx Mailto PwndLocker QakBot REvil Ryuk SMAUG SunCrypt TrickBot WastedLocker
2020-08-26 ⋅ Bleeping Computer ⋅ Lawrence Abrams
SunCrypt Ransomware sheds light on the Maze ransomware cartel
SunCrypt
Yara Rules
[TLP:WHITE] win_suncrypt_auto (20260917 | Detects win.suncrypt.)
rule win_suncrypt_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.suncrypt."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.suncrypt"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0f28d3 660ffe9530ffffff 660feff2 660f380035???????? 0f28de 660ffe5d90 0f28c3 }
            // n = 7, score = 200
            //   0f28d3               | movaps              xmm2, xmm3
            //   660ffe9530ffffff     | paddd               xmm2, xmmword ptr [ebp - 0xd0]
            //   660feff2             | pxor                xmm6, xmm2
            //   660f380035????????     |     
            //   0f28de               | movaps              xmm3, xmm6
            //   660ffe5d90           | paddd               xmm3, xmmword ptr [ebp - 0x70]
            //   0f28c3               | movaps              xmm0, xmm3

        $sequence_1 = { 33c0 803d????????01 56 0f95c0 c745d000000000 6800040000 8945cc }
            // n = 7, score = 200
            //   33c0                 | xor                 eax, eax
            //   803d????????01       |                     
            //   56                   | push                esi
            //   0f95c0               | setne               al
            //   c745d000000000       | mov                 dword ptr [ebp - 0x30], 0
            //   6800040000           | push                0x400
            //   8945cc               | mov                 dword ptr [ebp - 0x34], eax

        $sequence_2 = { 8b9514feffff 8b8560feffff 8b540204 8bca 8d7902 660f1f440000 }
            // n = 6, score = 200
            //   8b9514feffff         | mov                 edx, dword ptr [ebp - 0x1ec]
            //   8b8560feffff         | mov                 eax, dword ptr [ebp - 0x1a0]
            //   8b540204             | mov                 edx, dword ptr [edx + eax + 4]
            //   8bca                 | mov                 ecx, edx
            //   8d7902               | lea                 edi, [ecx + 2]
            //   660f1f440000         | nop                 word ptr [eax + eax]

        $sequence_3 = { 0f1108 83423001 897df8 7506 ff4234 897df8 8b7da0 }
            // n = 7, score = 200
            //   0f1108               | movups              xmmword ptr [eax], xmm1
            //   83423001             | add                 dword ptr [edx + 0x30], 1
            //   897df8               | mov                 dword ptr [ebp - 8], edi
            //   7506                 | jne                 8
            //   ff4234               | inc                 dword ptr [edx + 0x34]
            //   897df8               | mov                 dword ptr [ebp - 8], edi
            //   8b7da0               | mov                 edi, dword ptr [ebp - 0x60]

        $sequence_4 = { 8b8574ffffff 040b 83f061 884583 8b8574ffffff 040c 83f074 }
            // n = 7, score = 200
            //   8b8574ffffff         | mov                 eax, dword ptr [ebp - 0x8c]
            //   040b                 | add                 al, 0xb
            //   83f061               | xor                 eax, 0x61
            //   884583               | mov                 byte ptr [ebp - 0x7d], al
            //   8b8574ffffff         | mov                 eax, dword ptr [ebp - 0x8c]
            //   040c                 | add                 al, 0xc
            //   83f074               | xor                 eax, 0x74

        $sequence_5 = { 56 51 e8???????? 83c408 84c0 0f84c2000000 0fb74612 }
            // n = 7, score = 200
            //   56                   | push                esi
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   84c0                 | test                al, al
            //   0f84c2000000         | je                  0xc8
            //   0fb74612             | movzx               eax, word ptr [esi + 0x12]

        $sequence_6 = { c6853cffffff37 33c9 c6853dffffff2d c6853effffff64 c6853fffffff7c c68540ffffff7f }
            // n = 6, score = 200
            //   c6853cffffff37       | mov                 byte ptr [ebp - 0xc4], 0x37
            //   33c9                 | xor                 ecx, ecx
            //   c6853dffffff2d       | mov                 byte ptr [ebp - 0xc3], 0x2d
            //   c6853effffff64       | mov                 byte ptr [ebp - 0xc2], 0x64
            //   c6853fffffff7c       | mov                 byte ptr [ebp - 0xc1], 0x7c
            //   c68540ffffff7f       | mov                 byte ptr [ebp - 0xc0], 0x7f

        $sequence_7 = { ff7510 8b7508 ff750c c6451700 56 e8???????? 83c40c }
            // n = 7, score = 200
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   c6451700             | mov                 byte ptr [ebp + 0x17], 0
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_8 = { ff15???????? 5e 5b 57 6a00 ff15???????? 50 }
            // n = 7, score = 200
            //   ff15????????         |                     
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   57                   | push                edi
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   50                   | push                eax

        $sequence_9 = { 57 50 e8???????? 83c40c 83473001 7503 }
            // n = 6, score = 200
            //   57                   | push                edi
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   83473001             | add                 dword ptr [edi + 0x30], 1
            //   7503                 | jne                 5

    condition:
        7 of them and filesize < 172032
}
Download all Yara Rules