Ransomware.live - Group : Suncrypt

Ransomware Group:

Suncrypt

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Sites

Title	Available	Last Visit	FQDN	Screenshot
News	🔴	2023-05-02 09:44:39.121114	x2miyuiwpib2imjr5ykyjngdu7v6vprkkhjltrk4qafymtawey4qzwid.onion	N/A
None	🔴	2021-05-01 00:00:00.000000	nbzzb6sa6xuura2z.onion	N/A

Yara Rules

Click here to open yara rules

Ransom Note(s)

Click here to see Ransom Note(s)

Activity over time

Worldmap

32 Victims

SOCOTEC

Ransomware Group:

Discovery Date: 2022-06-18 02:21

Sector:

Group:

Northeastern Technical College

Ransomware Group:

Discovery Date: 2022-06-04 01:54

Sector:

Group:

Co-opbank Pertama

Ransomware Group:

Discovery Date: 2022-04-24 00:38

Sector:

Group:

DJS associate

Ransomware Group:

Discovery Date: 2022-04-16 02:50

Sector:

Group:

Gemeente Buren

Ransomware Group:

Discovery Date: 2022-04-14 13:28

Sector:

Group:

Atlas Copco

Ransomware Group:

Discovery Date: 2022-04-14 02:50

Sector:

Group:

Oklahoma City Indian Clinic

Ransomware Group:

Discovery Date: 2022-03-28 02:53

Sector:

Group:

FitFlop Ltd.

Ransomware Group:

Discovery Date: 2022-03-17 19:23

Sector:

Group:

Migros

Ransomware Group:

Discovery Date: 2022-03-16 06:20

Sector:

Group:

Royal Smilde

Ransomware Group:

Discovery Date: 2022-02-21 23:18

Sector:

Group:

CENTRAL BAPTIST COLLEGE

Ransomware Group:

Discovery Date: 2022-02-21 16:24

Sector:

Group:

KVK Tech | Specialty Brands and Generics

Ransomware Group:

Discovery Date: 2022-02-15 14:29

Sector:

Group:

Heartland Alliance

Ransomware Group:

Discovery Date: 2022-02-08 11:20

Sector:

Group:

Community Health Center | Valle del Sol

Ransomware Group:

Discovery Date: 2022-02-08 11:20

Sector:

Group:

Consumers Supply Distributing LLC

Ransomware Group:

Discovery Date: 2022-02-05 21:23

Sector:

Group:

Bohlin Cywinski Jackson

Ransomware Group:

Discovery Date: 2021-12-03 18:58

Sector:

Group:

Read more

Ransomware Group:

Discovery Date: 2021-11-30 17:59

Sector:

Group:

Hospitality Furnishings & Design Inc.

Ransomware Group:

Discovery Date: 2021-11-19 17:04

Sector:

Group:

Herman & Kittle Properties Inc.

Ransomware Group:

Discovery Date: 2021-11-19 17:04

Sector:

Group:

Outdoor Venture Corporation (OVC)

Ransomware Group:

Discovery Date: 2021-11-05 00:30

Sector:

Group:

Tri-signal Intergration

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

Glen Dimplex Home Appliances

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

Grushwitz

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

Mark A. O'neal and Associates

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

AGSO

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

Dean and Fulkerson

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

SB Zantal Markt

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

JSW Steel USA

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

PRP diagnostic imaging

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

Cornerstone Automation Systems, LLC

Ransomware Group:

Discovery Date: 2021-09-09 23:46

Sector:

Group:

University Hospital New Jersey

Ransomware Group:

Discovery Date: 2020-09-01 00:00

Sector: Healthcare and Public Health

Group:

Haywood County School District

Ransomware Group:

Discovery Date: 2020-08-24 00:00

Sector: Education Facilities

Group:

×

Infostealer information available for

Employees(s)	Customer(s)	Third Party Employee(s)

This information is provided by HudsonRock

×

/*
SunCrypt ransomware
*/


rule SunCrypt
{
    meta:
        author = "rivitna"
        family = "ransomware.suncrypt.windows"
        description = "SunCrypt ransomware Windows payload"
        severity = 10
        score = 100

    strings:
        $h0 = { B0 00 02 00 C7 00 A3 00 00 00 [8-16] 83 C? 20 }
        $h1 = { C7 00 A3 00 00 00 [8-16]
                ( 81 C7 B0 00 02 00 83 C? 20 | 83 C? 20 81 C7 B0 00 02 00) }

        $s1 = "-noshares\x00" wide
        $s2 = "\x00-nomutex\x00" wide
        $s3 = "\x00-noreport\x00" wide
        $s4 = "\x00-noservices\x00" wide
        $s5 = "\x00-justcrypt\x00" wide
        $s6 = "\x00-keep_exe\x00" wide
        $s7 = "\x00$Recycle.bin\x00" wide
        $s8 = "%s\\efi\\microsoft\\boot\\bootmgr.efi\x00" wide
        $s9 = "YOUR_FILES_ARE_ENCRYPTED.HTML\x00" wide
        $s10 = "\x0D... %d ...\x00" ascii

        $a1 = "<a href=\"http://" ascii xor(0x11-0x22)
        $a2 = ".onion/chat.html?" ascii xor(0x11-0x22)
        $a3 = "<h2>Why pay us?</h2>" ascii xor(0x11-0x22)
        $a4 = "background-color: #1a1a1a;" ascii xor(0x11-0x22)
        $a5 = "rem !important;" ascii xor(0x11-0x22)
        $a6 = "TOR browser" ascii xor(0x11-0x22)
        $a7 = "torproject.org" ascii xor(0x11-0x22)

    condition:
        ((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
        (
            (1 of ($h*)) or
            (5 of ($s*)) or
            (4 of ($a*))
        )
}