Trojan;Win32/Sonbokli.A!cl

We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn Microsoft threat actor names

Aliases: No associated aliases

Trojan:Win32/Sonbokli.A!cl remains an active threat against Windows devices, operating as both a loader and a remote access tool. It steals login credentials, adds infected devices to botnets, and delivers additional threats like ransomware and coin miners. Government agencies, public sector groups, and everyday Windows users are their main targets. Its danger comes from its use of living off the land methods. Instead of dropping large amounts of unique code, it takes over trusted Windows components, particularly those linked to the .NET Framework, to run its payload and stay hidden. This lets it blend in with regular Windows processes while opening the door for more damaging attacks.

Isolate infected devices from the network immediately to prevent data exfiltration and lateral movement to other devices.

Disconnect the infected device from the network right away to stop data theft and further commands.

Use Process Explorer to find and end malicious processes if Task Manager is blocked or ineffective.

Watch RegAsm.exe, RegSvcs.exe, or MSBuild.exe running from .NET Framework folders that show odd behavior like network activity or high CPU use.

Restart the device in Safe Mode so that automatic startup routines don't interfere with cleanup.

Turn off System Restore to keep the malware from coming back through saved restore points.

Run a full scan with Microsoft Defender (with the latest definitions) while in Safe Mode.

After the scan, manually check the registry for persistence entries like PMtmP under the Run key and delete them.

Remove any leftover files from %Application Data%\PMtmPI\ and %AppDataLocal% folders.

Treat all passwords and credentials used on the infected device as compromised. Change them from a different, clean device.

Keep a close eye on bank and credit card accounts for unauthorized transactions. Cancel any cards whose details were saved on the device.

Check out OAuth application logs and revoke any permissions that were granted without authorization during the infection.

Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.

You can also visit our advanced troubleshooting page or the Microsoft virus and malware community for more help.

Trojan:Win32/Sonbokli.A!cl gains access through social engineering. Threat actors send phishing emails disguised as court orders or legal notices. These messages contain Microsoft Office documents, usually .doc files, with malicious macros. If the recipient allows macros, the document runs obfuscated commands that download and launches the trojan.

More recent campaigns abuse OAuth redirection. The target clicks a phishing link that starts a legitimate OAuth login flow. But altered redirect parameters send the user to a threat actor-controlled site after authentication. That site often pushes a ZIP archive containing LNK shortcut files or HTML smuggling loaders, which complete the infection. Malicious PDF files also serve as delivery tools. They look like remittance invoices, shipping tracking documents, or Teams meeting invitations.

Some PDFs have embedded scripts that load the trojan directly, while others contain links to malicious domains hosted on dynamic DNS services or public file sharing platforms. Once the initial loader runs, Sonbokli establishes itself by abusing Microsoft .NET Framework utilities. It looks for three specific tools in the %Windows%\Microsoft.NET\Framework\v2.0.50727\ folder: RegAsm.exe, RegSvcs.exe, and MSBuild.exe . The malware injects its code into these processes, so its activity appears to come from trusted Windows components. RegAsm.exe handles assembly registration and code execution.

RegSvcs.exe helps with service installation and process hollowing. MSBuild.exe compiles and runs malicious scripts from memory. Version 2.0 of the .NET Framework is common in enterprise settings, which helps the malware work on many devices. To keep running after a reboot, the trojan uses several persistence methods. One variant creates a folder in the user's application data directory and adds a registry value under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run . The value name is PMtmP , and its data points to %Application Data%\PMtmPI\WinDriv.url . That .url file then starts the main binary PMtmP.exe . This indirect approach uses Windows shell functionality instead of calling the .exe directly from the registry.

Other versions modify uninstall keys in HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL to look like a legitimate installed program. They also place shortcut files (.lnk) in the user's Startup folder under Roaming AppData. Sonbokli communicates with command-and-control servers through domains registered with dynamic DNS providers, which let threat actors change IP addresses quickly.

Observed domains include apple-locked[.]hopto[.]org used in PDF phishing, and payloads are often fetched from paths like /download/XXXX after OAuth redirection. Early delivery stages have used shortened links such as . The malware leaves file artifacts in predictable spots: %AppDataLocal%\GDIPFONTCACHEV1.DAT, %Application Data%\ExkcFpa.exe, and the PMtmPI folder with WinDriv.url and PMtmP.exe . It also drops a file at C:\Program Files\simplewall\uninstall.exe to mimic legitimate software.

Set Microsoft Office to deactivate all macros by default. Allow only macros that are digitally signed or approved by an administrator.

Use current Office versions so that Protected View can open downloaded documents in a sandbox, blocking automatic code execution.

Deploy endpoint detection and response tools that watch for unusual behavior from trusted Windows files. For example, flag any attempt by MSBuild.exe to make outbound network connections.

Set policies in cloud identity systems to limit which third-party app users can authorize.

Require multi-factor authentication for any changes to OAuth app permissions.

Watch for silent OAuth probes where apps try to redirect users without showing a token request.

Keep Windows and the .NET Framework patched regularly.

Teach users to check who sent an email before clicking links or opening attachments, even if the message looks like it came from a court or a known company.

Make users aware of OAuth redirect risks and tell them to report any unexpected app authorization prompts right away.

Create a clear process for users to report suspicious activity to IT, so threats can be contained quickly.

Turn on network protection features that can block suspicious connection attempts from Windows processes.

For more tips on how to keep your device safe, go to the Microsoft security help & learning portal .

Devices affected by this threat can exhibit the following unexpected behaviors:

Windows performance drops sharply because the malware uses heavy CPU resources for coin mining or encrypting files.

Programs freeze often, response times lag, and the device crashes unexpectedly.

Available disk space shrinks quickly as the malware creates temporary files to hold stolen data before sending it out.

New, unfamiliar files appear in %Application Data% and %AppDataLocal% folders.

Desktop wallpaper or browser homepage changes without user action.

Documents won't open, and their file names show added extensions like .locked after ransomware activates.

Unusual amounts of outbound network traffic go to unknown destinations, especially when the computer is idle.

Network protection logs record suspicious connection attempts from trusted processes like MSBuild.exe and RegAsm.exe.