# Pony (Fareit/Siplog) Credential-Stealing Trojan and Downloader

> Pony, also tracked as Fareit and Siplog, is a Windows credential-stealing trojan with an integrated downloader, first observed in 2011 and still active through June 2026. It harvests stored credentials from 100+ applications (web browsers, FTP/SSH clients, email clients, instant messengers, RDP sessions, and 36+ cryptocurrency wallets), brute-forces local Windows accounts with a built-in password dictionary, and delivers second-stage payloads such as ZeuS/Zbot.

- **Published:** 2026-06-19T00:00:00Z
- **Last reviewed:** 2026-06-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0867
- **ID:** TL-2026-0867
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Pony (Fareit/Siplog) is a modular, assembly-based information stealer and downloader for Windows that has been in continuous circulation since 2011. The malware ships in two parts: a graphical 'Pony Builder' point-and-click configurator that lets non-developers set the C2 panel URL, second-stage payload URLs, executable icon, and feature toggles (loader activation, duplicate-run prevention); and the compiled bot/loader written largely in hand-crafted x86 assembly. Each build produces a distinct binary despite identical logic, frustrating signature detection.

After execution the loader fingerprints the host (CPU architecture via GetNativeSystemInfo / IsWow64Process, hardware ID derived from a WinRAR registry value or, as a fallback, a GUID from CoCreateGuid), then walks the user profile (AppData, Local AppData, Cache, Cookies, History) and parses application-specific credential stores. Public technical analyses document on the order of 134 dedicated harvesting routines covering 15+ browsers (Chrome 'Login Data'/'Web Data', Firefox SQLite/text stores, Opera, Yandex), 50-62 FTP clients (FileZilla sitemanager.xml/recentservers.xml, WinSCP registry, SmartFTP), email clients (Outlook, Thunderbird, The Bat!, Becky!), RDP .rdp files, certificate private keys (OID 2.5.29.37), and 36-40 cryptocurrency wallets (Bitcoin wallet.dat, Litecoin, Electrum, Armory). It can additionally brute-force local Windows accounts with a built-in dictionary of common passwords (e.g. '123456') via NetUserEnum/LogonUserA.

Harvested data ('passbag') is exfiltrated to an attacker-operated PHP panel using a hand-built HTTP POST over raw Winsock with a fixed Internet Explorer 8 User-Agent. The body is protected with a two-stage RC4 scheme: the passbag is checksummed and RC4-encrypted with a hardcoded key (e.g. 'password22'), then re-encrypted with a randomly generated key that is appended to the blob, so decryption happens server-side. C2 endpoints follow recognizable gate.php conventions (/pony/gate.php, /ponyd/gate.php, /v6/gate.php, .../panel/gate.php). Once data is sent the bot can download and execute second-stage malware (most famously ZeuS/Zbot in a 2013 campaign) and self-deletes its loader via a temporary %TEMP% batch script.

Pony is heavily armored: software packing in a nested 'matryoshka' / custom-crypter layout, PUSH-to-RET and rogue-byte (0xFE padding) control-flow obfuscation to defeat disassemblers, GetTickCount/heuristic timing loops and time-based delays to evade sandboxes, PEB BeingDebugged checks, Sandboxie detection (sandboxierpcss), VM detection via WMI video-controller queries, and Avast/AVG detection through the snxhk.dll hook library (some .NET-wrapped variants perform process hollowing into RegASM.exe). The public leak of Pony builder/loader source for versions 1.9 and 2.0 on underground forums has driven extensive customization and reuse; observed versions range from 1.7 through 2.2. It is widely distributed via spam email (password-protected ZIP attachments impersonating banks, malicious JavaScript/Office documents, and .scr download links) and exploit kits, and per BlueLiv has at times accounted for roughly 39% of active credential-theft malware worldwide.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1087 Account Discovery
- T1012 Query Registry
- T1005 Data from Local System
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1588 Obtain Capabilities

## Sources

- [What Is Pony Malware? Analysis of the Fareit Credential Stealer](https://www.picussecurity.com/resource/blog/what-is-pony-malware-analysis-of-the-fareit-credential-stealer)
- [Pony or Fareit Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/pony/)
- [Malware Analysis - Pony (Guillaume Orlando)](https://guillaumeorlando.github.io/Pony-malware-analysis)
- [A Pony Hidden in Your Secret Garden (CyberArk Threat Research)](https://www.cyberark.com/resources/threat-research-blog/a-pony-hidden-in-your-secret-garden)
- [Pony: A Breakdown of the Most Popular Malware in Credential Theft (Acunetix)](https://www.acunetix.com/blog/articles/pony-malware-credential-theft/)
- [Trojan-PWS:W32/Fareit (F-Secure description)](https://www.f-secure.com/v-descs/trojan-pws-w32-fareit.shtml)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0867