PonyFinal malware: What it is, how it works and how to prevent it | Malware spotlight
Introduction to PonyFinal
PonyFinal ransomware appeared for the first time in 2020. It is malware that relies on human-operated attacks, i.e., attacks that exploit information security vulnerabilities of the targeted systems. Such vulnerabilities may include network weaknesses like bottlenecks and network disruptions.
During the COVID-19 pandemic, the number of cyberattacks using human-operated ransomware increased significantly. Other types of human-operated ransomware include Maze, REvil (Sodinokibi), RobbinHood and NetWalker.
Become a certified reverse engineer!
Human-operated ransomware typically affects fewer computers than malware that propagates through phishing. This is because the former type of malware requires well-planned targeted attacks, while the latter type spreads automatically.
The purpose of this article is to examine the operation of PonyFinal and provide recommendations on how to avoid an infection with it. At the end of the article, we provide concluding remarks.
The operation of PonyFinal
PonyFinal is usually installed by conducting brute-force attacks that allow fraudsters to gain unauthorized access to an account on the targeted computer. We can define a brute-force attack as an attack that consists of submitting a large number of passwords with the aim of guessing the correct password.
Once the fraudsters compromise the targeted computer, they deploy:
- A Visual Basic script running a PowerShell reverse shell that has the capacity to steal local data
- A system that bypasses event logging
Next, the crooks gain unauthorized access to other computers within the compromised network. Afterwards, they proceed with the actual installation of PonyFinal.
PonyFinal is usually installed on workstations using the Java Runtime Environment (JRE). This is because the malware is written in Java. However, Microsoft observed cases where the JRE was installed by fraudsters in order to serve as a foundation for running the malware.
The malware starts encrypting the files of the infected computer shortly after it is executed. It adds an additional “.enc” extension to each encrypted file. The user of the infected computer is presented with a ransom note named README_files.txt. It is full of language mistakes and includes instructions on how to pay the requested ransom. An excerpt from the ransom note follows.
“To decrypted files, you need to obtain private key.
“The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
“The server will destroy the key within 72 hours after encryption completed.
“Pay us 300 BTC, and we will decode up to 3 sample files you send us via email for verification to prove we deliver master key.”
PonyFinal uses a strong encryption mechanism. As of this writing, there is no way to decrypt the files without paying the requested ransom.
Avoiding an infection with PonyFinal
PonyFinal can be avoided by taking measures against the brute-force attacks that are at the core of the malware propagation model. Such measures need to include an account lockout policy, challenge-response tests and strong password policies. Let’s take a look.
An account lockout policy
Since brute-force attacks require a large number of password entry attempts in order to guess the correct password, organizations will benefit from adopting policies allowing up to three password entries. Once the three attempts are exhausted, further attempts can be made only after the administrator reactivates the account.
A major disadvantage of this method is that it allows fraudsters to permanently block the access to user accounts by submitting multiple password entries.
An account lockout policy may also be based on progressive delays, i.e., after each failed attempt, user accounts are locked out for a set period of time. This time is increased with each failed password entry.
Challenge-response tests
Another way to prevent brute-force attacks include the use of challenge-response tests, such as CAPTCHA. The abbreviation CAPTCHA refers to “completely automated public Turing test to tell computers and humans apart.” CAPTCHAs usually require the evaluation and the entry of a sequence of letters and numbers that appear in a distorted image.
Although the use of CAPTCHAs is an effective technique, its main drawback is that it reduces the accessibility and usability of the computers on which it is installed.
It should be noted that CAPTCHAs can also be compromised. Greg Mori and Jitendra Malik published a paper entitled “Recognizing Objects in Adversarial Clutter: Breaking a Visual CAPTCHA,” which includes a detailed method for circumventing one of the most popular CAPTCHAs (EZ-Gimpy). The effectiveness of the method is 92%.
Strong passwords policies
Brute-force attacks are usually ineffective against lengthy and complex passwords consisting of 15 and more characters including uppercase and lowercase letters, numbers and symbols. Therefore, organizations willing to avoid being infected with PonyFinal are advised to create and enforce password policies and require their staff to adhere to them.
The policies also need to include a list of prohibited passwords, such as passwords containing personal names, dates of births, dictionary words, previous passwords or a common keyboard pattern (e.g., qwerty or 12345678).
Concluding remarks regarding PonyFinal
PonyFinal is an emerging threat that should not be underestimated. This relatively new malware is installed on the targeted computers by using well-planned manual operations.
PonyFinal has the capacity to encrypt most files stored on the compromised networks and this, in turn, may lead to paralysis of entire networks. Once the files are encrypted, paying the ransom remains the only solution to recover the files. It is not a coincidence that many large organizations, even police departments, paid millions to operators of various types of ransomware.
Prevention remains the only effective method against PonyFinal and other types of crypto-ransomware. We discussed three prevention measures that organizations can take to protect against PonyFinal. Their purpose is to avoid brute-force attacks that allow fraudsters to install PonyFinal on the targeted computers.
Become a certified reverse engineer!
Sources
- Microsoft warns about attacks with the PonyFinal ransomware, ZDNet
- Human-operated ransomware attacks: A preventable disaster, Microsoft
- Mori and J. Malik, "Recognizing objects in adversarial clutter: breaking a visual CAPTCHA," IEEE
- Techniques for preventing a brute force login attack, Computer Weekly
- Exam Pass Guarantee
- Live expert instruction
- Hands-on labs
- CREA exam voucher
In this Series
- PonyFinal malware: What it is, how it works and how to prevent it | Malware spotlight
- How AsyncRAT is escaping security defenses
- Chrome extensions used to steal users' secrets
- Luna ransomware encrypts Windows, Linux and ESXi systems
- Bahamut Android malware and its new features
- LockBit 3.0 ransomware analysis
- AstraLocker releases the ransomware decryptors
- Analysis of Nokoyawa ransomware
- Goodwill ransomware group is propagating unusual demands to get the decryption key
- Dangerous IoT EnemyBot botnet is now attacking other targets
- Fileless malware uses event logger to hide malware
- Nerbian RAT Using COVID-19 templates
- Popular evasion techniques in the malware landscape
- Sunnyday ransomware analysis
- 9 online tools for malware analysis
- Blackguard malware analysis
- Behind Conti: Leaks reveal inner workings of ransomware group
- ZLoader: What it is, how it works and how to prevent it | Malware spotlight [2022 update]
- WhisperGate: A destructive malware to destroy Ukraine computer systems
- Electron Bot Malware is disseminated via Microsoft's Official Store and is capable of controlling social media apps
- SockDetour: the backdoor impacting U.S. defense contractors
- HermeticWiper malware used against Ukraine
- MyloBot 2022: A botnet that only sends extortion emails
- Mars Stealer malware analysis
- How to remove ransomware: Best free decryption tools and resources
- Purple Fox rootkit and how it has been disseminated in the wild
- Deadbolt ransomware: The real weapon against IoT devices
- Log4j - the remote code execution vulnerability that stopped the world
- Rook ransomware analysis
- Modus operandi of BlackByte ransomware
- Emotet malware returns
- Mekotio banker trojan returns with new TTP
- Android malware BrazKing returns
- Malware instrumentation with Frida
- Malware analysis arsenal: Top 15 tools
- Redline stealer malware: Full analysis
- A full analysis of the BlackMatter ransomware
- A full analysis of Horus Eyes RAT
- REvil ransomware: Lessons learned from a major supply chain attack
- Pingback malware: How it works and how to prevent it
- Android malware worm auto-spreads via WhatsApp messages
- Malware analysis: Ragnarok ransomware
- Taidoor malware: what it is, how it works and how to prevent it | malware spotlight
- SUNBURST backdoor malware: What it is, how it works, and how to prevent it | Malware spotlight
- ZHtrap botnet: How it works and how to prevent it
- DearCry ransomware: How it works and how to prevent it
- How criminals are using Windows Background Intelligent Transfer Service
- How the Javali trojan weaponizes Avira antivirus
- HelloKitty: The ransomware affecting CD Projekt Red and Cyberpunk 2077
- DreamBus Botnet: An analysis
- Kobalos malware: A complex Linux threat
Get certified and advance your career!
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, ISC2, Cisco, Microsoft and more!
Malware analysis
Malware analysis
Malware analysis
Malware analysis