Pony Fareit 08th November 2025 - Sandbox detonation analysis + C&C threat intelligence and OSINT analysis

in data


In the present article we are going to analyze with sandbox detonation a Pony Fareit malware sample. The threat gets information about language and geographical references of the victim machine:



It gets information and data from FTP clients, browser user data and profiles, Outlook Accounts and Profiles data and details, credentials saved in files:





The malware enumerates the details of installed software through Uninstall registry keys details:




The bat malicious script dropped under AppData\Local\Temp folder executes a malicious JS script which works as an installer for the final stage stealer artifact. The script also gets details about the credentials in the victim machine:





We can see details related to the Windows Script Host platform:



There are also details that could be associated to Windows Defender evasion:



Here are the OSINT details of the Pony sample:


The main Pony malware contacts the C&C domain central[.]pk, registered 14 years ago and probably compromised, it has mixed HTTP and HTTPS content:






Here is a behaviour process related to the scripts dropping phase and CMD execution:

 


The C&C IP address 5.134.14[.]119 has been registered in UKDedicated LTD in UK and it has the following opened ports and services:

21 (FTP), 22 (SSH), 25 (SMTP), 80 (HTTP), 110 (POP3), 143 (IMAP), 443 (HTTP), 465/ (SMTP), 587 (SMTP), 993 (IMAP), 995 (POP3), 2078 (HTTP), 2080 (HTTP), 2083 (HTTP), 2087 (HTTP), 2096 (HTTP)


Here is the FTP opened service evidence that could be used to download further artifacts but also upload stolen data:


The C&C IP address has critical OpenSSH vulnerabilities:



The JA3S thumbprint of the FTP service is 15af977ce25de452b96affa2addb1036:



Here are further details about the C&C IP address in question and some domains associated:



An identifying mutex name could be "ShimViewer":




IOCs:

  • 121a8901094eb205730a3a7f3e176335bf000600c2af96e75c887d61b5e1fbe3
  • 5feb6fe845540343871b2261c87d9e45ff998690
  • 6fec34fdee381c173c2a43697c69c43d
  • 936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
  • 4eec9d50360cd815211e3c4e6bdd08271b6ec8e6
  • 3880eeb1c736d853eb13b44898b718ab
  • central[.]pk
  • ShimViewer
Yara rules:

import "vt"

rule Pony_08112025 {
  condition:
   for any t in vt.behaviour.tls: (t.ja3s == "15af977ce25de452b96affa2addb1036") and vt.net.url.raw icontains "central[.]pk"
}

rule PonyFareit_08112025

{

    strings:

        $str = "ShimViewer"

        $hex = { 53 68 69 6d 56 69 65 77 65 72 }

    condition:

        any of them

}