Pony (Fareit/Siplog) Credential-Stealing Trojan and Downloader — Threadlinqs Intelligence
As of 2026-06-19, Pony (Fareit/Siplog) Credential-Stealing Trojan and Downloader is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-0867 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Pony, also tracked as Fareit and Siplog, is a Windows credential-stealing trojan with an integrated downloader, first observed in 2011 and still active through June 2026. It harvests stored
Pony (Fareit/Siplog) is a modular, assembly-based information stealer and downloader for Windows that has been in continuous circulation since 2011. The malware ships in two parts: a graphical 'Pony Builder' point-and-click configurator that lets non-developers set the C2 panel URL, second-stage payload URLs, executable icon, and feature toggles (loader activation, duplicate-run prevention); and the compiled bot/loader written largely in hand-crafted x86 assembly. Each build produces a distinct binary despite identical logic, frustrating signature detection.
After execution the loader fingerprints the host (CPU architecture via GetNativeSystemInfo / IsWow64Process, hardware ID derived from a WinRAR registry value or, as a fallback, a GUID from CoCreateGuid), then walks the user profile (AppData, Local AppData, Cache, Cookies, History) and parses application-specific credential stores. Public technical analyses document on the order of 134 dedicated harvesting routines covering 15+ browsers (Chrome 'Login Data'/'Web Data', Firefox SQLite/text stores, Opera, Yandex), 50-62 FTP clients (FileZilla sitemanager.xml/recentservers.xml, WinSCP registry, SmartFTP), email clients (Outlook, Thunderbird, The Bat!, Becky!), RDP .rdp files, certificate private keys (OID 2.5.29.37), and 36-40 cryptocurrency wallets (Bitcoin wallet.dat, Litecoin, Electrum, Armory). It can additionally brute-force local Windows accounts with a built-in dictionary of common passwords (e.g. '123456') via NetUserEnum/LogonUserA.
Harvested data ('passbag') is exfiltrated to an attacker-operated PHP panel using a hand-built HTTP POST over raw Winsock with a fixed Internet Explorer 8 User-Agent. The body is protected with a two-stage RC4 scheme: the passbag is checksummed and RC4-encrypted with a hardcoded key (e.g. 'password22'), then re-encrypted with a randomly generated key that is appended to the blob, so decryption happens server-side. C2 endpoints follow recognizable gate.php conventions (/pony/gate.php, /ponyd/gate.php, /v6/gate.php, .../panel/gate.php). Once data is sent the bot can download and execute second-stage malware (most famously ZeuS/Zbot in a 2013 campaign) and self-deletes its loader via a temporary %TEMP% batch script.
Pony is heavily armored: software packing in a nested 'matryoshka' / custom-crypter layout, PUSH-to-RET and rogue-byte (0xFE padding) control-flow obfuscation to defeat disassemblers, GetTickCount/heuristic timing loops and time-based delays to evade sandboxes, PEB BeingDebugged checks, Sandboxie detection (sandboxierpcss), VM detection via WMI video-controller queries, and Avast/AVG detection through the snxhk.dll hook library (some .NET-wrapped variants perform process hollowing into RegASM.exe). The public leak of Pony builder/loader source for versions 1.9 and 2.0 on underground forums has driven extensive customization and reuse; observed versions range from 1.7 through 2.2. It is widely distributed via spam email (password-protected ZIP attachments impersonating banks, malicious JavaScript/Office documents, and .scr download links) and exploit kits, and per BlueLiv has at times accounted for roughly 39% of active credential-theft malware worldwide.
Target sectors: financial, government, healthcare, technology, retail, general
Target regions: North America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566, T1189, T1204, T1059, T1106, T1027, T1140, T1055, T1497