Pony 1.9 (Win32/Fareit)

Came across a Pony panel recently and the original one not the 'TF' version.
Alright let's talk about Pony, the guys have some cool stats.
The panel is on 95.170.83.145 and the sql server used by pony is located elsewhere on 178.63.77.68

I've tried to add my own user inside the panel, but i got some difficulty forcing me to dump the f*cker and review the source code.
I've read just a small part of the code but that was fun, here is the authentication function:

They call mixed_sha1():
random_salt_value_start, random_salt_value_end are strings who don't change, but the coder named them 'random' for an unknown reason, i'm still not sure if joke or human stupidity.

ok cool, i know how to hash my password, where they records IPs now ?
Panel in Russian but code comments in English... ok i start to believe a retard edited the code.

get_login_log():

Alright, let's get bad guys IPs:
SELECT * FROM pony_system_log WHERE log_source LIKE 'login'
And that all i need to know for remove traces after on the panel and stay stealth.

Now let's have a fast look on Pony builder:
Loader:
Settings:
Themes:

Changelog (available here http://pastebin.com/ufiueRSH):

Files:
The builder is coded with Delphi and the payload in assembler.

Pony 1.9 got leaked in december 2012 and translated to English by Unic0de.
Personally at the end of 2012 i've do a courtesy visit to a PPI affiliate (Hacking Moneycloud)

Someone trying to sell Pony the same day it got leaked (lol?):

Now for the panel of our bad guys, login:

Dashboard:

FTP list:

Filters:
Countries:
Date:

HTTP list:

Others:

Stats:

Stolen passwords in the last 24 hours:

Stolen passwords in the last month:

 OS popularity:

FTP Clients popularity:

 Browsers popularity:

E-mail client popularity:

Domains:

Error logs:

Error report:

Reports:

View report:

Management:

Server Settings:

Add New User:

Change password:

Help:

Panel (Russian) can be downloaded here: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=1558&p=19374#p19374