Pony

Pony, also known as Fareit and Siplog, is a long-running commodity malware family categorized primarily as a loader and information stealer, and it has also been described as functioning as a botnet tool. It has remained active for more than a decade and has been used both to steal credentials and other information and to deliver additional malware during attacks. The leaked Pony source code reportedly contributed to its broad adoption by both organized and less organized criminal actors.

Pony is commonly delivered through phishing and spearphishing attachments, including archives and documents, as well as compromised web pages, fake software downloads, exploit kits, and other malware delivery chains. The content specifically notes delivery via Hancitor, RockLoader, H1N1, Bedep, and campaigns involving CVE-2015-0311 and CVE-2017-11882. It has also appeared in campaigns alongside HawkEye and has been used by Nigerian BEC actors tracked as SilverTerrier and by the Nigerian TMT group. The content also associates Pony use with Cobalt Group, TA505, and TA544.

Technically, many analyzed Pony samples are .NET binaries that extract embedded secondary modules at runtime. Reported behaviors include anti-analysis checks for sandbox and virtualized environments, inspection of running processes for analysis or security tools, self-copying, auxiliary file launch, batch-file self-deletion, and persistence via registry keys including HKCU\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load, HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run, and HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce. Pony has been observed injecting into or hollowing processes, including .NET-related processes such as vbc.exe, AppLaunch.exe, MSBuild.exe, installutil.exe, regasm.exe, aspnet_compiler.exe, and regsvcs.exe. It has also used NetUserEnum to enumerate local accounts.

Its payload establishes command-and-control communications and steals data by reading configuration files and Windows registry entries. The malware targets credentials and data from FTP clients, browsers, and email software, including WinSCP, FileZilla, WS_FTP, Opera, Mozilla, Chrome, Windows Live Mail, PocoMail, and BatMail. The same network channel can be used to deploy additional malware or maintain remote control. Pony command-and-control panels have frequently been hosted on previously compromised legitimate websites, complicating infrastructure tracking.

High-confidence indicators mentioned in the content include SHA-256 hashes 1a1dc33fae444afdd54f6f50dd47ed4b9f673fbc5595dad7b48e78cac0458465 and 6a581c0c07ceb888ea418fccffd5efba33b9fd6561be1bcf90b0d6ba4deefd05.