From c282899db7098ef73d18091fb12d7acd5a76431d Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Wed, 6 Sep 2017 15:23:27 +0200
Subject: [PATCH] add SyncCrypt Ransomwar

---
 clusters/ransomware.json | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index b5400a7..71dd290 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -8549,6 +8549,22 @@
           "RESTORE_INFO-[id].txt"
         ]
       }
+    },
+    {
+      "value": "SyncCrypt",
+      "description": "A new ransomware called SyncCrypt was discovered by Emsisoft security researcher xXToffeeXx that is being distributed by spam attachments containing WSF files. When installed these attachments will encrypt a computer and append the .kk extension to encrypted files.",
+      "meta": {
+        "refs": [
+          "https://www.bleepingcomputer.com/news/security/synccrypt-ransomware-hides-inside-jpg-files-appends-kk-extension/"
+        ],
+        "extension": [
+          ".kk"
+        ],
+        "ransomnotes": [
+          "readme.html",
+          "readme.png"
+        ]
+      }
     }
   ],
   "source": "Various",