Trusted Design

Possible Credential Stealing Malware

概要

We found a machine on our network making suspicious call outs to a Russian domain, but our anti-malware tool did not block the application. Analysis of malware identified a host of passwords in a memory dump and we later received a report from a third party security firm that the very same user's credentials were found in a Pony malware password dump. These are the IOCs we were able to identify regarding this malware. We believe that the source of the infection was a phishing campaign that had attached RTF files. The files asked the user to enable macros. In this case the user did enable macros and the infection began. The original RTF files and the downloaded executable were stored on the Users temp directory under a randomly generated folder name.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Malicious VBScript file delivers Pony Loader (score: 0.67)
• Trojan.Doc.Scam.K (score: 0.64)
• Malicious Office files dropping Kasidet and Dridex (score: 0.62)
• Fake WordPress Site Receiving credentials from malware (score: 0.62)
• Source of a user credential stealing phishing attack (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る