MALICIOUS — 07e01575db8e5a3b8a97aa7977a631e541f412548d16f15f8744969f1540d609.exe

MALICIOUS — 07e01575db8e5a3b8a97aa7977a631e541f412548d16f15f8744969f1540d609.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Sonbokli family. 6 of 26 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 07e01575db8e5a3b8a97aa7977a631e541f412548d16f15f8744969f1540d609
• SHA-1: 34dc012e9f8a987b38fe2f775d37782d2c9d04e9
• MD5: b2070d140b362a0ad381ae4c6dcf48a7
• imphash: 4ba3f97ab4d7908411ad46e497198ac7
• ssdeep: 393216:Jk6feU57UkCiUAIMkbElXMCHWUjXTcuI3/PGTAI:JB2C7udg3lXMb8XQH/O7
• TLSH: T1856E3352535B3090C5E3F564BC898CEDE063F5A61572A55E2E03EC1FA4C0A738CF2A5A
• Submitted as: 07e01575db8e5a3b8a97aa7977a631e541f412548d16f15f8744969f1540d609.exe
• File type: pe · Size: 14280086 bytes
• Verdict: malicious (99/100) · Family: Sonbokli

Source: MalwareBazaar · first seen 2026-07-28T00:00:00.000Z · SHA-256 verified

Detections (6 of 26 engines)

• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: Trojan:Win32/Sonbokli.A!cl
• Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
• Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen

MITRE ATT&CK

• T1543.003
• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Sonbokli.A!cl (rule Trojan:Win32/Sonbokli.A!cl) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.14068 (rule Gen:Variant.Yogi.14068) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

8874 behavior events · 2 ATT&CK techniques · 27 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/5502/files/f04d8510531508259c215f0fef2a0db3226f6b0be23e923ad3f75abb187dd86a - f04d8510531508259c215f0fef2a0db3226f6b0be23e923ad3f75abb187dd86a
• /opt/CAPEv2/storage/analyses/5502/files/eb84c7d42b6b6366474168d06457cdc9a9005bccb6b040d7f6e2afc0be1fbf00 - eb84c7d42b6b6366474168d06457cdc9a9005bccb6b040d7f6e2afc0be1fbf00
• /opt/CAPEv2/storage/analyses/5502/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
• /opt/CAPEv2/storage/analyses/5502/files/dbd8f41859b5160b0e743a7d0d4c974475397ea9fbc2f137f84bae9013419da4 - dbd8f41859b5160b0e743a7d0d4c974475397ea9fbc2f137f84bae9013419da4
• /opt/CAPEv2/storage/analyses/5502/files/c62663de84df35b60ca7e1b0eb8b8c97c83cd53b6da504e7acb307bfbafd433e - c62663de84df35b60ca7e1b0eb8b8c97c83cd53b6da504e7acb307bfbafd433e
• /opt/CAPEv2/storage/analyses/5502/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
• /opt/CAPEv2/storage/analyses/5502/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
• /opt/CAPEv2/storage/analyses/5502/files/100308346698ec88fde3029e76551c8a9ea87fbdb3fd000b825af14dd5a927ea - 100308346698ec88fde3029e76551c8a9ea87fbdb3fd000b825af14dd5a927ea
• /opt/CAPEv2/storage/analyses/5502/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - 7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824
• /opt/CAPEv2/storage/analyses/5502/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
• /opt/CAPEv2/storage/analyses/5502/files/4f9b9d1ae301b370bb1992634cd6dc44ccf4988b4385f07f8c50c500e24714c2 - 4f9b9d1ae301b370bb1992634cd6dc44ccf4988b4385f07f8c50c500e24714c2
• /opt/CAPEv2/storage/analyses/5502/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
• /opt/CAPEv2/storage/analyses/5502/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
• /opt/CAPEv2/storage/analyses/5502/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 - a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
• /opt/CAPEv2/storage/analyses/5502/files/96037ae9988ea16935c3f4774f85aa33b83fe8beb3cad49bbc94bf04e689a7fb - 96037ae9988ea16935c3f4774f85aa33b83fe8beb3cad49bbc94bf04e689a7fb

Embedded URLs

• http://schemas.microsoft.com/SMI/2016/WindowsSettings

Embedded domains

• schemas.microsoft.com
• 5.fi
• 6.me
• i.us
• 8.ru

File paths

• w:\n

More Sonbokli samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report