What Is Pony Malware? Analysis of the Fareit Credential Stealer

Key Takeaways

• Pony, also known as Fareit and Siplog, combines a credential stealer with a downloader that delivers additional malware payloads.
• Leaked source code and a point-and-click Pony Builder let non-developers compile customized variants, fueling its widespread, recurring use.
• Pony harvests stored credentials from browsers, FTP, email, and SSH clients, then brute-forces local Windows accounts using a built-in dictionary.
• After exfiltrating credentials, Pony downloads second-stage payloads like the ZeuS banking trojan, then self-deletes to reduce forensic traces.
• Picus Platform simulates Pony attacks so security teams can validate their security controls against real-world threats.

Pony, also tracked as Fareit and Siplog, is one of the longest-lived credential-stealing families in the commodity malware ecosystem, which was first observed in 2011. It is best understood as two tools fused into one binary: a broad credential and information stealer, and a lightweight downloader (loader) that pulls additional payloads onto a freshly compromised host.

What made Pony so widespread was not technical sophistication but availability. The source code for Pony Loader and its graphical builder leaked publicly. With both in circulation on underground forums, anyone could compile a customized variant, point it at their own panel, and wrap it in a fresh packer to evade signatures. The result is a family that keeps reappearing across unrelated campaigns.

This analysis reconstructs Pony's behavior from two distinct real-world campaigns:

• A 2013 campaign in which Pony was delivered inside a password-protected ZIP attached to spam disguised as a secure banking message, and then used as a downloader to install a ZeuS / Zbot banking trojan [1].
• A later campaign in which Pony was delivered through a link in a spam email that downloaded a file with a deceptive .scr extension, after which it attempted to phone home and pull a second-stage payload [2].

What is Pony Malware?

Pony malware is a Windows credential-stealing trojan with an integrated downloader. It extracts saved passwords from FTP clients, browsers, email clients, and other applications, exfiltrates them to an attacker-controlled panel over HTTP, then optionally downloads and executes a second-stage payload such as a banking trojan or ransomware.

Its core execution sequence, in order, is:

1. Fingerprint the infected system (architecture, hardware ID, user data paths).
2. Enumerate and extract stored credentials from FTP clients, web browsers, email clients, instant messengers, terminal/SSH clients, file-sharing tools, and more.
3. Brute-force local Windows accounts using a built-in dictionary of common passwords.
4. Report the harvested data back to a command-and-control (C&C) panel over HTTP.
5. Download and execute one or more additional payloads (the downloader/loader function).
6. Delete its own loader from disk to reduce forensic traces.

What Makes Pony Malware Different From Other Credential Stealers?

Pony's defining characteristic is the combination of its leaked source code and the Pony Builder, a point-and-click configurator that makes building a customized variant accessible to non-developers.

An operator pastes in the list of URLs to receive stolen passwords, the list of URLs from which to download second-stage payloads, an icon to disguise the binary, and enables toggles such as "Activate loader" and "Do not run duplicate file(s)."

Because the configuration is baked into each build at compile time, every campaign produces a different binary while the underlying logic remains identical. This is why defenders see Pony as a "first contact" infection whose primary danger is what it delivers next.

How Does Pony Malware Work?

Pony malware works in 7 distinct stages: delivery, unpacking, anti-analysis, credential harvesting and local account brute force, exfiltration, second-stage download, and self-deletion. Each stage is covered in detail below.

1. How Is Pony Malware Delivered?

Pony malware is almost always delivered via spam email, but operators vary the lure and file format heavily between campaigns. Two delivery methods are documented here.

• Method A: Password-protected ZIP masquerading as a secure banking message. In the 2013 campaign, the email impersonated a financial services "Secure Email Notification," instructing the recipient to open an attached encrypted ZIP with a password supplied directly in the message body:

• Method B: A download link delivering a deceptive .scr file. In the later campaign, there was no attachment. It was offering links that all resolved to the same file:

The trick here is the .scr extension. .scr files are Windows screensavers, but a screensaver is a standard executable that Windows runs identically to an .exe. Users conditioned to distrust .exe attachments are far less wary of .scr.

In both cases, the end result is identical: a Windows executable that, when run, deploys the Pony trojan.

2. Packing and the Loader-Inside-a-Loader Structure

The file the victim executes is generally not Pony itself. It is a packer or crypter stub whose only purpose is obfuscation. This layering is the primary reason Pony repeatedly evades signature detection.

In the 2013 sample, the Pony body was compressed with a known packer, leaving a fingerprint in the binary:

In the later sample, the outer .scr was a standalone packing layer that loaded a second, fully independent executable into memory at runtime: the Pony Loader. The full structure was:

3. How Does Pony Malware Evade Analysis?

Once unpacked, Pony does not encrypt its strings or hide its API calls, but it does obfuscate control flow at the entry point to defeat disassemblers and slow manual analysis. Two techniques are used together.

Technique 1: PUSH-to-RET control flow obfuscation

Instead of CALL or JMP, the code pushes a target address onto the stack and executes RET, which pops it and jumps there.

Junk instructions and a bogus, never-taken conditional jump are inserted between the PUSH and the RET to break linear-sweep disassemblers:

The malware’s purpose here is to make analysis harder while fooling the debugger. Because debuggers can misunderstand the code incorrectly in these situations:

Technique 2: GetTickCount timing loop

Pony calls GetTickCount in a tight loop and only proceeds when the result mod 10 equals exactly 5. Because the tick count is effectively random at any execution moment, the loop runs a pseudo-random number of iterations before continuing, frustrating sandboxes with fixed timeouts and slowing manual stepping:

4. System Fingerprinting and Credential Harvesting

Pony then fingerprints the host and begins extracting credentials. The system-information stage uses standard Windows APIs to establish architecture and build a hardware identifier for victim tracking:

Pony then walks well-known user data paths to locate where applications store credentials:

Pony's credential-theft logic is modular. In the leaked source, support for each target application is wrapped in a conditional-compilation flag, so the builder can include or exclude individual grabbers per campaign.

The 2013 sample also contained logic targeting Facebook-related data, with the URL lightly obfuscated by swapping adjacent character pairs:

Beyond scraping stored secrets, Pony ships a built-in dictionary of the most commonly used passwords and uses it to attack local Windows accounts. It enumerates accounts with NetUserEnum, then cycles the dictionary against each one using LogonUserA:

On a successful login, Pony impersonates the account, loads its user profile with LoadUserProfileA, harvests profile-scoped data, then reverts and unloads cleanly to avoid leaving the host in a broken state.

5. Network Communication and Exfiltration

Pony exfiltrates stolen data via raw Winsock with a hand-built HTTP POST. Stolen data is uploaded as a single binary blob. The HTTP request template is stored as a format string:

6. The Loader Stage and Second-Stage Payload

The loader function iterates a hard-coded list of URLs, downloads an executable from the first URL that responds, saves it with a .exe extension, and runs it.

For example, in the 2013 campaign, the loader pulled a ZeuS / Zbot banking trojan.

7. Persistence and Self-Deletion

Pony copies itself out of its original location into the user profile using randomized filenames and falsified timestamps, then erases its loader from disk after the second-stage payload is running.

After the loader executes, Pony drops a small batch script into %TEMP% via ShellExecuteA and launches it. The script loops until the loader process has released its file lock, deletes the loader, then deletes itself:

What is the Impact of Pony Malware?

The damage from a Pony malware infection compounds across multiple layers.

Credential theft is immediate and broad: stored passwords from browsers, FTP clients, email clients, and SSH tools are harvested in a single pass. Stolen FTP credentials are then used to compromise hosting servers, letting the malware propagate itself to new victims. Any host with a weak local-account password can be fully taken over via the bundled dictionary brute force.

The longer-term impact is driven by the loader stage. A single Pony infection can deliver a banking trojan, ransomware, or any other payload the operator chooses, enrolling the machine in a botnet and turning a credential-theft incident into a sustained, multi-stage compromise.

How Picus Simulates Pony Malware Attacks?

We also strongly suggest simulating Pony Malware Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other malware variants, such as BRICKSTORM, VenomRAT, Chinotto, and Rustonotto, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the Pony Malware Attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] “Case of Pony downloading ZeuS via Passworded Zip Attachment of Malvertisement Campaign.” Available: https://blog.malwaremustdie.org/2013/06/case-of-pony-downloaded-zeus-via.html. [Accessed: Jun. 15, 2026]

[2] hasherezade, “No money, but Pony! From a mail to a trojan horse,” Malwarebytes, Nov. 18, 2015. Available: https://www.malwarebytes.com/blog/news/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse. [Accessed: Jun. 15, 2026]