File name:

e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387

Full analysis: https://app.any.run/tasks/08d6fc75-92c8-4836-8b8b-e4979e89bb84
Verdict: Malicious activity
Threats:

Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America.

Malware Trends Tracker     >>>
Analysis date: May 21, 2025, 17:22:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
trojan
pony
fareit
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 2 sections
MD5:

C12F21AC16B8C50139B24F512D6ECCB9

SHA1:

0A99454CE8F3A9F573F653CA9257712548B8532D

SHA256:

E957083A789D119F5E5A8694F13B849767FF64D2E8BE7933387D8D1A4AFA4387

SSDEEP:

768:LGyX6hWI23liB1+fJt8m9QazEKm4R/PqkYjFn3DioLo4uuAqOyPRrlINtNZtHoxD:c23EjGiuQFgRHOnTDuEZrlyXXAVDp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Actions looks like stealing of personal data

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Pony/Fareit Trojan is detected

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • PONY has been detected (SURICATA)

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Connects to the CnC server

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

  • SUSPICIOUS

    • Searches for installed software

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Executing commands from a ".bat" file

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Contacting a server suspected of hosting an CnC

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Reads security settings of Internet Explorer

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Connects to the server without a host name

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Starts CMD.EXE for commands execution

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Potential Corporate Privacy Violation

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

  • INFO

    • Checks supported languages

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Create files in a temporary directory

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Process checks computer location settings

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Reads the software policy settings

      • slui.exe (PID: 3676)

    • Reads the computer name

      • e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe (PID: 5116)

    • Checks proxy server information

      • slui.exe (PID: 3676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Mew compressed Win32 Executable (88.8)
.exe | Win32 Executable (generic) (5.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: -
CodeSize: 512
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x230c5
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #PONY e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe slui.exe cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3676C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4756C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\1175281.bat" "C:\Users\admin\Desktop\e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe" "C:\Windows\SysWOW64\cmd.exe—e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5116"C:\Users\admin\Desktop\e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe" C:\Users\admin\Desktop\e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6264\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 023
Read events
4 019
Write events
4
Delete events
0

Modification events

(PID) Process:(5116) e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR
Operation:writeName:HWID
Value:
7B35454444323339362D314346382D344432442D424531432D4341394432384545343642327D
(PID) Process:(5116) e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5116) e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5116) e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
5116e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exeC:\Users\admin\AppData\Local\Temp\1175281.battext
MD5:3880EEB1C736D853EB13B44898B718AB
SHA256:936D9411D5226B7C5A150ECAF422987590A8870C8E095E1CAA072273041A86E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
7
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
POST
—
193.111.136.16:80
http://193.111.136.16/panel/gate.php
unknown
—
—
malicious
2104
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
POST
—
193.111.136.16:80
http://193.111.136.16/panel/gate.php
unknown
—
—
malicious
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
POST
—
193.111.136.16:80
http://193.111.136.16/panel/gate.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
193.111.136.16:80
—
—
DE
malicious
2104
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6436
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3676
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
magicent.us
  • —
unknown

Threats

PID
Process
Class
Message
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
A Network Trojan was detected
ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Internet Explorer Version MSIE 5.
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
Potential Corporate Privacy Violation
ET INFO Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
A Network Trojan was detected
ET MALWARE Generic Request to gate.php Dotted-Quad
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
5116
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
e957083a789d119f5e5a8694f13b849767ff64d2e8be7933387d8d1a4afa4387