PONY | FAREIT. Stealer, Loader, and Botnet.

Pony (Fareit/Siplog) is a long-lived loader/stealer and botnet malware; this report provides a detailed technical analysis of its infection vectors (phishing, exploit kits, fake downloads), runtime behavior (module extraction, self- and cross-process injection, UPX-packed payloads), persistence via auxiliary files and registry Run keys, anti-analysis checks, and data exfiltration targets (FTP clients, browsers, email clients). The author includes sample IOCs, typical C2 panel paths, detection opportunities mapped to ATT&CK techniques, and notes on actor usage and underground market activity.