MITRE ATT&CKsoftware (malware)
S0453 Pony
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2020-05-21
Description
Pony is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.
Related
Uses · MITRE ATT&CK (16)
- T1027.015 Compression sub-technique
- T1027.016 Junk Code Insertion sub-technique
- T1071.001 Web Protocols sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.003 Time Based Checks sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1087.001 Local Account sub-technique
- T1110.001 Password Guessing sub-technique
- T1070.004 File Deletion sub-technique
- T1036 Masquerading technique
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
References
- https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/ Malwarebytes Pony April 2016