SunCrypt - Ransomware

The ransomware shares an IP address with Maze ransomware and uses an obfuscated PowerShell script to install the malicious software. SunCrypt appends a hexadecimal hash to encrypted files and drops a ransom note stating that not only was the victim's data encrypted it was also exfiltrated and will be published or sold if the ransom is not paid.