Laboratorio Malware: BOTNET PONY 1.9 Malware

For the past few months has been detected at Crimeware scene a new class of Malware called PONY Bonet. The Pony Control panel is identified by the logo of a this animal that appears in the famous Facebook game "Farmville"

The login screen panel of this new botnet Pony is:

Once control panel is accessed, it displays a menu with all available options. It can see that has been developed to capture all types of passwords and login credentials of infected users when they access applications and Internet sites. This is a very powerful type of Spy - Keylogger Malware with very dangerous features.

Pony Trojan is configured to capture all kinds of confidential information and access passwords for the following applications:

Passwords for FTP and SSH servers. The Trojan is able to recognize almost all FTP & SSH applications both commercial and opensource and extract its credentials:

System Info , FAR Manager , Total Commander , WS_FTP , CuteFTP , FlashFXP , FileZilla , FTP commander , BulletProof FTP , SmartFTP , TurboFTP , FFFTP , CoffeeCup FTP / Sitemapper , CoreFTP , FTP Explorer , Frigate3 FTP , SecureFX , UltraFXP , FTPRush , WebSitePublisher , BitKinex , ExpanDrive , ClassicFTP , Fling , SoftX , Directory Opus , FreeFTP / DirectFTP , LeapFTP , WinSCP , 32bit FTP , NetDrive , WebDrive , FTP Control , Opera , WiseFTP , FTP Voyager , Firefox , FireFTP , SeaMonkey , Flock , Mozilla , LeechFTP , Odin Secure FTP Expert , WinFTP , FTP Surfer , FTPGetter , ALFTP , Internet Explorer , Dreamweaver , DeluxeFTP , Google Chrome , Chromium / SRWare Iron , ChromePlus , Bromium (Yandex Chrome) , Nichrome , Comodo Dragon , RockMelt , K-Meleon , Epic , Staff-FTP , AceFTP , Global Downloader , FreshFTP , BlazeFTP , NETFile , GoFTP , 3D-FTP , Easy FTP , Xftp , FTP Now , Robo-FTP , LinasFTP , Cyberduck , Putty , Notepad++ , CoffeeCup Visual Site Designer , FTPShell , FTPInfo , NexusFile , FastStone Browser , CoolNovo , WinZip , Yandex.Internet , MyFTP , sherrod FTP , NovaFTP , Windows Mail , Windows Live Mail , Becky! , Pocomail , IncrediMail , The Bat! , Outlook , Thunderbird , FastTrack .

Screen from menu management of the FTP grabber :

Also captures all kind of e-mails and their passwords, stored certificates and RDP passwords

Control panel allows capturing all types of passwords for loging web applications on HTTP and HTTPS. It has a very powerful filter to configure Captures, selecting or excluding Internet domains to start capturing data when infected users access in these pages, and selects by text strings, domains , countries , dates, etc.

The statistical panel shows confidential data captured from Web browsing of infected users.

compromised Users by the Trojan Pony are ordered by their IP, the information gathered can be selected for each user by selecting the desired IP profile: