Sonbokli malware family
Sonbokli is a malware family tracked by MalwareAnalyzer by Cyble across 9 publicly analyzed samples. First seen 2026-07-28, most recently 2026-07-30. Observed ATT&CK techniques include T1112, T1543.003, T1105.
Corpus statistics
- Publicly analyzed samples: 9
- First seen: 2026-07-28
- Last seen: 2026-07-30
- Verdicts: malicious 7, suspicious 2
- File types: lnk 7, elf 1, pe 1
ATT&CK techniques used by Sonbokli
Extracted command-and-control infrastructure
- http://upx.sf.net - 1 sample
Recent Sonbokli samples
- 07e01575db8e5a3b8a97aa7977a631e541f412548d16f15f8744969f1540d609.exe - malicious (2026-07-30)
- photov_145078426722.lnk - malicious (2026-07-29)
- photov_142177907826.lnk - malicious (2026-07-29)
- photov_815344310912.lnk - malicious (2026-07-29)
- 3fc30b1df7c5fde1acb66eed7a784cceddb38c6607843343ead274e0a49d568a.elf - malicious (2026-07-29)
- photov_460772503095.lnk - malicious (2026-07-29)
- photov_127567101143.lnk - malicious (2026-07-29)
- photov_541097563367.lnk - suspicious (2026-07-29)
- photov_457828597195.lnk - suspicious (2026-07-28)
Frequently asked about Sonbokli
- What is Sonbokli?
- Sonbokli is a malware family tracked by MalwareAnalyzer by Cyble across 9 publicly analyzed samples. First seen 2026-07-28, most recently 2026-07-30. Observed ATT&CK techniques include T1112, T1543.003, T1105.
- How many Sonbokli samples have been analyzed?
- MalwareAnalyzer by Cyble holds 9 publicly analyzed samples attributed to Sonbokli, first seen 2026-07-28 and most recently 2026-07-30. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does Sonbokli use?
- Across our Sonbokli samples the most frequently observed techniques are T1112 (6), T1543.003 (5), T1105 (1). Counts are the number of analyzed samples in which each technique was observed.
- What file types does Sonbokli use?
- Sonbokli samples in this corpus are distributed as lnk (7), elf (1), pe (1).
- Does Sonbokli use command-and-control infrastructure?
- Yes. 1 distinct command-and-control indicator has been extracted from Sonbokli samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is Sonbokli malicious?
- 7 of 9 analyzed Sonbokli samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends