Day 22: Suncrypt Ransomware

The Suncrypt ransomware is distributed through a dynamic link library (DLL) file that encrypts computer files when accessed. The ransomware uses an obfuscated PowerShell script to install the malicious software. When the Suncrypt ransomware is activated on the victim’s system, it implements various malicious changes impacting system settings and leaves the system very vulnerable to additional malware attacks. Every time the infected system starts up, the ransomware threat begins automatically. All malicious processes including data encryption can occur in the background of all other running processes and remain hidden. After the Suncrypt ransomware activates a built-in cipher module, it encrypts valuable files leaving them inaccessible. The threat actors possess a specific tool for decrypting the files encoded by the Suncrypt ransomware.