malware family
SunCrypt
SunCrypt ransomware was discovered in October 2019 and in August 2020 it was added to Maze ransomware’s cartel. It also follows some of Maze’s tactics, techniques, and procedures. SunCrypt is launched and installed using an obfuscated PowerShell script. Infected email attachments (macros), torrent websites, malicious ads act as carriers for this ransomware.
Curated · btcintel
claims we make, each with its source and citation · sources may contradict; we show the set, never a score
Facts
- id
- suncrypt
- kind
- malware family
- status
- unknown
- aliases
- Sun
- jurisdictions
- —
- claims naming it
- 2 · 0 attributions · 0 relations · 0 events
Identifiers
- misp-galaxy 4fa25527-99f6-42ee-aaf2-7ca395e5fabcvia misp-galaxy-ransomware
Relations
computedno relations recorded for this entity
Events
computedno dated events recorded for this entity
Claims naming this entitynewest first · 2 of 2
- SunCryptransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment bc1qpmknwh4pgvkyqq840fhx7fw36nrzu8gskx369v · 744,842,773 sat · time 2021-07-19 21:45 UTC · url https://ransomwhe.re/#address/bc1qpmknwh4pgvkyqq840fhx7fw36nrzu8gskx369vfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_24913btcintel:annotations:24913@v3 sha256:4f533ae0a412661bconfidencetrusted provider · 50
- SunCryptransomwarepayment addresssourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencefamily raw SunCrypt · url https://ransomwhe.re/#address/bc1qpmknwh4pgvkyqq840fhx7fw36nrzu8gskx369vfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2ann_24912btcintel:annotations:24912@v2 sha256:48fb7ace1feb2747confidencetrusted provider · 50
Subjects2 subjects carry a claim naming this entity · a sample
Community
notes from Nostr labelers · never merged with the bands above · not endorsed
Community content is indexed from Nostr and not endorsed by btcintel.
not computed yetNot indexed yet: the community index has not looked at this subject.