For the past few months has been detected at Crimeware scene a new class of Malware called PONY Bonet. The Pony Control panel is identified by the logo of a this animal that appears in the famous Facebook game "Farmville"
The login screen panel of this new botnet Pony is:
Once control panel is accessed, it displays a menu
with all available options. It can see that has been developed to capture all
types of passwords and login credentials of infected users when they access
applications and Internet sites. This is a very powerful type of Spy -
Keylogger Malware with very dangerous features.
Pony Trojan is configured to capture all kinds of
confidential information and access passwords for the following applications:
Passwords for FTP and SSH servers. The Trojan is able
to recognize almost all FTP & SSH applications both commercial and
opensource and extract its credentials:
System Info ,
FAR Manager , Total Commander , WS_FTP , CuteFTP , FlashFXP , FileZilla , FTP
commander , BulletProof FTP , SmartFTP , TurboFTP , FFFTP , CoffeeCup FTP /
Sitemapper , CoreFTP , FTP Explorer , Frigate3 FTP , SecureFX , UltraFXP ,
FTPRush , WebSitePublisher , BitKinex , ExpanDrive , ClassicFTP , Fling , SoftX
, Directory Opus , FreeFTP / DirectFTP , LeapFTP , WinSCP , 32bit FTP ,
NetDrive , WebDrive , FTP Control , Opera , WiseFTP , FTP Voyager , Firefox ,
FireFTP , SeaMonkey , Flock , Mozilla , LeechFTP , Odin Secure FTP Expert ,
WinFTP , FTP Surfer , FTPGetter , ALFTP , Internet Explorer , Dreamweaver ,
DeluxeFTP , Google Chrome , Chromium / SRWare Iron , ChromePlus , Bromium
(Yandex Chrome) , Nichrome , Comodo Dragon , RockMelt , K-Meleon , Epic ,
Staff-FTP , AceFTP , Global Downloader , FreshFTP , BlazeFTP , NETFile , GoFTP
, 3D-FTP , Easy FTP , Xftp , FTP Now , Robo-FTP , LinasFTP , Cyberduck , Putty
, Notepad++ , CoffeeCup Visual Site Designer , FTPShell , FTPInfo , NexusFile ,
FastStone Browser , CoolNovo , WinZip , Yandex.Internet , MyFTP , sherrod FTP ,
NovaFTP , Windows Mail , Windows Live Mail , Becky! , Pocomail , IncrediMail ,
The Bat! , Outlook , Thunderbird , FastTrack .
Screen from menu management of the FTP grabber :
Also captures all kind of e-mails and their passwords,
stored certificates and RDP passwords
Control panel allows capturing all types of passwords
for loging web applications on HTTP and HTTPS. It has a very powerful filter to
configure Captures, selecting or excluding Internet domains to start capturing
data when infected users access in these pages, and selects by text strings,
domains , countries , dates, etc.
The statistical panel shows confidential data captured
from Web browsing of infected users.
compromised Users by the Trojan Pony are ordered by
their IP, the information gathered can be selected for each user by selecting
the desired IP profile:
It is very interesting to see in the statistical panel
the variety of data types that can be captured by the Trojan from infected
users
All captured data is encrypted and stored in a MySQL
database to prevent being stolen if someone gains access to this information:
Finally we present part
of file structure
of the KIT PONY
Troyan:
Also Have been found other malicious addresses
containing Pony panels actives at:
hXXp://217.195.200.12:8080/ponyb/admin.php
hXXp://195.5.208.204:8080/ponyb/admin.php
hXXp://9jal33ts.com/ponysample/admin.php
hXXp://198.27.83.179/popo/
hXXp: http://hostohu.net/p0x/admin.php
hXXp://vpro.juplo.com/p/admin.php
