The Rise of Pony Malware and What it Means for Organizations

Introduction to Pony Malware

Pony, also recognized as Fareit or Siplog, operates as an information stealer and loader, serving as malware designed to gather data from compromised systems and facilitate the installation of other malicious programs. This particular virus made its initial appearance in the wild in 2011, primarily targeting users in Europe and North America.

The earliest identified iteration of Pony stealer is version 1.7, with the most recent known version being 2.2. Despite regular updates, the malware has not undergone groundbreaking feature enhancements since its initial discovery by Microsoft. In addition to its core functionality, Pony possesses the capability to pilfer credentials from cryptocurrency wallets, FTP clients, and autofill values stored in browsers.

Diverging from the typical botnet structure, Pony stealer does not rely on a centralized Command and Control (C&C) server or a network of such servers for executing its attacks. Instead, each attacker can establish a customized control server or acquire a server previously configured by another malefactor, instantly gaining access to infrastructure that generates reports on the pilfered data. Furthermore, the malware itself comprises two modules: the builder, used to construct clients downloadable onto victims’ machines for data collection, and the bot, representing the final payload.

Deep Dive into Pony Malware

The Pony stealer builder functions as a tool for attackers to construct tailored Pony bots with pre-programmed C&C addresses for sending stolen data. The Pony Bot, the actual program responsible for information theft, is predominantly written in assembly language. A distinctive feature setting this malware apart is its unique decoding technique—the Bot lacks an embedded decoding algorithm and relies on simple functions programmed to transmit encrypted information to the control server, where the stolen data undergoes decryption.

Part of Pony’s notoriety stems from the leakage of the source code for multiple versions of Pony loader, available for download on darknet platforms. Notably, the source code for Pony builder and loader versions 1.9 and 2.0 can be found on several underground forums.

Despite the core features of the Pony trojan remaining relatively consistent over its lifespan, newer versions have incorporated several anti-detection features to impede research and disassembly. In addition to standard anti-evasion and debugging techniques, attackers can implement various packers, including custom ones, to thwart detection by antivirus software.

Delivery Methods of Pony Stealer Malware

Pony is distributed through diverse channels, including email spam campaigns, exploit kits, and DNS poisoning. Additionally, it can be concealed within free downloadable online programs, masquerading as legitimate software. For instance, malicious emails often contain either a Microsoft Word archive or a JavaScript file. Upon downloading and opening the document, Pony infiltrates the victim’s PC and initiates its execution.

Another avenue of Pony’s attack involves compromising a DNS server infected by another malware. In this scenario, the victim is redirected to a malicious website, from which Pony is downloaded onto the user’s PC.

Impact of Pony Malware

The widespread availability and robust feature set have positioned Pony stealer as one of the most prevalent information stealers. It is frequently utilized in attacks targeting Europe and North America, posing an enhanced threat due to its nesting-doll-like design, where the final payload resides within a layered package, facilitating evasion of easy detection.

Researchers note that Pony Stealer functions as a potent password stealer, capable of decrypting or unlocking passwords for over 110 different applications, encompassing VPNs, FTP clients, email services, instant messaging platforms, web browsers, and more. Once Pony Stealer infects a PC, it transforms the device into a botnet, leveraging the infected PCs to propagate further infections.

About Check Point Exposure Management

Check Point Exposure Management is an intelligence-led, validation-driven, remediation-first unified platform that helps security teams move quickly and safely from exposure visibility to exposure reduction. Delivered through a single UI, it brings together threat intelligence, exposure prioritization, Agentic Exposure Validation, and safe remediation so teams can understand risk, prove exploitability, and act from one place.