About “PonyStealer.8 (B)” infection

The PonyStealer.8 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PonyStealer.8 (B) virus can do?

Behavioural detection: Executable code extraction – unpacking
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine PonyStealer.8 (B)?


File Info:
name: 266403A7A94C5C333093.mlw
path: /opt/CAPEv2/storage/binaries/631e487da7f3c81eed5e64efad8ac9c7f40dbcf3893664eddc5c01fad252977f
crc32: 573E6479
md5: 266403a7a94c5c333093052c666531d7
sha1: 7c208f6bef5ca3a8d02d4feae496d3e3940bbc15
sha256: 631e487da7f3c81eed5e64efad8ac9c7f40dbcf3893664eddc5c01fad252977f
sha512: 2e809d83f745851480bd90b61cb2e4ecfe944dead98d8e176f1f5e7f62d04c0e705fcdd26a7123c0d905c19ac96e124e9305c63432eba786a43a32e7263ab0b8
ssdeep: 12288:1WpHqIBxgh1I+rsBDa5x3PR0jRlw1Wd48mZSeDWloszHldt0Dh:16jG9dR2jR61AmZtDMJHld2N
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11ED4EF518EB47F19ED96443543A12AAE004D2D6F4BF4020EBD5EDD0F7B92E9A30EF891
sha3_384: cd054eb37724a6281d477c97590c5558251e3ed6e504e2be6f54c9b256780635469ee75b99284daeb16bebb298be9e21
ep_bytes: 68fc314900e8f0ffffff000000000000
timestamp: 2004-11-17 09:57:25

Version Info:
Translation: 0x0409 0x04b0
CompanyName: WO
ProductName: Project1
FileVersion: 1.00
ProductVersion: 1.00
InternalName: startup
OriginalFilename: startup.exe

PonyStealer.8 (B) also known as:

CyrenCloud	Risk/WIN_PE.631e487d!Threatlookup
Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Gen:Variant.PonyStealer.8
FireEye	Gen:Variant.PonyStealer.8
Skyhigh	BehavesLike.Win32.BadFile.jc
McAfee	Artemis!266403A7A94C
Cylance	unsafe
APEX	Malicious
BitDefender	Gen:Variant.PonyStealer.8
Ad-Aware	Gen:Variant.PonyStealer.8
Emsisoft	Gen:Variant.PonyStealer.8 (B)
VIPRE	Gen:Variant.PonyStealer.8
Trapmine	malicious.high.ml.score
Antiy-AVL	Trojan/Win32.Wacatac
Arcabit	Trojan.PonyStealer.8
GData	Gen:Variant.PonyStealer.8
ALYac	Gen:Variant.PonyStealer.8
MAX	malware (ai score=83)
Malwarebytes	MachineLearning/Anomalous.100%
TrendMicro-HouseCall	TROJ_GEN.R002H09GU23
Rising	Trojan.Wacatac!8.10C01 (CLOUD)
MaxSecure	Trojan.Malware.12334671.susgen
DeepInstinct	MALICIOUS

How to remove PonyStealer.8 (B)?

PonyStealer.8 (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X