rule malware_windows_pony_stealer
{
    meta:
        description = "Pony stealer malware"
        reference = "https://www.knowbe4.com/pony-stealer"
        author = "@mimeframe"
        md5 = "5e52ce394c3be2a685dbb8f435e2f64f"
    strings:
        $a1 = "signons.sqlite" nocase wide ascii
        $a2 = "signons.txt" nocase wide ascii
        $a3 = "signons2.txt" nocase wide ascii
        $a4 = "signons3.txt" nocase wide ascii
        $a5 = "WininetCacheCredentials" nocase wide ascii
        $a6 = "moz_logins" nocase wide ascii
        $a7 = "encryptedPassword" nocase wide ascii
        $a8 = "FlashFXP" nocase wide ascii
        $a9 = "BulletProof" nocase wide ascii
        $a10 = "CuteFTP" nocase wide ascii
    condition:
        all of ($a*)
}