Procedure examples

Pony attachments have been delivered via compressed archive files.

Pony obfuscates memory flow by adding junk instructions when executing to make analysis more difficult.

Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.

Pony has used batch scripts to delete itself after execution.

Pony has used scripts to delete itself after execution.

Pony has sent collected information to the C2 via HTTP POST request.

Pony has collected the Service Pack, language, and region information to send to the C2.

Pony has used the NetUserEnum function to enumerate local accounts.

Pony can download additional files onto the infected system.

Pony has used several Windows functions for various purposes.

Pony has used a small dictionary of common passwords against a collected list of local accounts.

Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.

Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).

Pony has delayed execution using a built-in function to avoid detection and analysis.

Pony has been delivered via spearphishing attachments.

Pony has been delivered via spearphishing emails which contained malicious links.