Loading malware…
Phemedrone Stealer is a Windows-focused .NET information stealer written in C# and widely associated with credential and data theft from consumer applications and browsers. It has been described as open source and has been promoted in criminal ecosystems, while also appearing in active intrusion chains operated by multiple threat actors. The malware is designed to collect data in memory and steal information from Chromium- and Gecko-based browsers, cryptocurrency wallets, Discord, Telegram, FileZilla, Steam, screenshots, user files, and detailed host reconnaissance data. Reported theft includes passwords, cookies, browser-stored payment data, wallet material, messaging-session data, and other sensitive system information, followed by exfiltration to attacker-controlled infrastructure, including Telegram-based channels or bots.
Observed delivery chains show Phemedrone distributed through malicious Internet Shortcut files that exploit the Microsoft Windows Defender SmartScreen bypass vulnerability CVE-2023-36025. In documented campaigns, attackers used .url files to retrieve and execute Control Panel payloads, abuse signed Windows binaries, invoke PowerShell download stages, and fetch additional components from public hosting services before launching the final stealer. Other campaigns used social-engineering lures and multi-stage loaders, including encrypted PowerShell and .NET injector components, to hollow legitimate Windows processes and run Phemedrone under the guise of benign system activity. The malware has also been observed as an additional payload deployed by XWorm operators and as part of broader malware distribution ecosystems abusing platforms such as YouTube to push stealers through cracked-software and cheat-themed lures.
Phemedrone employs multiple defense-evasion and execution techniques in observed intrusions. These include SmartScreen bypass via CVE-2023-36025, obfuscated PowerShell stages, DLL sideloading, scheduled-task persistence, in-memory execution through Donut, API hashing, string encryption, packing and protector use, and process hollowing or injection through intermediary loaders. In one documented chain, a loader established persistence and repeatedly launched a sideloaded executable, which decrypted and executed a second-stage component before loading the final .NET stealer in memory. The malware has also been associated with anti-analysis claims such as anti-VM, anti-debug, and anti-CIS checks in criminal marketing.
Phemedrone primarily targets Windows users and is relevant to financially motivated cybercrime because of its focus on credentials, browser sessions, cryptocurrency assets, and messaging-platform data. It has been linked to exploitation activity by multiple criminal operators rather than a single exclusive actor, and code-level similarities have been noted between Phemedrone and other stealers such as Ov3r_Stealer. Its combination of commodity availability, active exploitation, and broad data-theft coverage makes it a notable infostealer in the current Windows threat landscape.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trend Micro as having put to use by threat actors to drop another stealer called Phemedrone Stealer by exploiting the Microsoft Windows Defender SmartScreen bypass flaw (CVE-2023-36025, CVSS score: 8.8). | Trustwave said it identified a near-identical infection chain ... to drop another stealer called Phemedrone Stealer by exploiting the Microsoft Windows Defender SmartScreen bypass flaw (CVE-2023-36025).
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Trustwave said it identified a near-identical infection chain ... to drop another stealer called Phemedrone Stealer by exploiting the Microsoft Windows Defender SmartScreen bypass flaw (CVE-2023-36025).
33 distinct techniques documented for this family, organized by ATT&CK tactic.
It then executes the schtasks.exe command with the arguments "/F /CREATE /TN \"Licensing2\" /tr \"C:\\Users\\Public\\Libraries\\Books\\WerFaultSecure.exe\" /sc minute /MO 90", scheduling the WerFaultSecure.exe to run at 90-minute intervals.
It then executes the schtasks.exe command with the arguments "/F /CREATE /TN \"Licensing2\" /tr \"C:\\Users\\Public\\Libraries\\Books\\WerFaultSecure.exe\" /sc minute /MO 90", scheduling the WerFaultSecure.exe to run at 90-minute intervals.
The file DATA3.txt is an additional obfuscated loader that uses PowerShell string and digit manipulation techniques to mask its contents and make deciphering its true purpose more difficult during static analysis.
Property Value ... Packer Costura/Fody (embedded dependency bundler) ... MITRE ATT&CK Mapping ... T1027.002 Costura/Fody packing
The loader uses a technique called dynamic API resolving to hide its API imports and make it harder for static analysis.
MITRE ATT&CK Mapping ... Defense Evasion Obfuscated Files or Information: Encrypted/Encoded File T1027.013 AES-256-CBC + XOR layered encryption
MITRE ATT&CK Mapping ... Defense Evasion Masquerading: Match Legitimate Name T1036.005 Phemedrone disguised as svchost.exe
ALTERNATE.dll's sole function is process hollowing: it spawns a suspended instance of aspnet_compiler.exe ... hollows out its memory, injects the final payload, and resumes execution.
This blog delves into the Phemedrone Stealer campaign's exploitation of CVE-2023-36025, the Windows Defender SmartScreen Bypass vulnerability, for its defense evasion.
Threat actors leverage MITRE ATT&CK technique T1218.002, which abuses the Windows Control Panel process binary (control.exe) to execute .cpl files.
"operator can configure anti-CIS, anti-VM, and anti-debugger protections"; and "perform anti-VM checks"
This loader downloads a ZIP file hosted on the same GitHub repository to a hidden directory created using the Windows attribute utility binary (attrib.exe).
For the final payload execution, Donut is configured to use the Unmanaged CLR Hosting API to load the Common Language Runtime (CLR). Once the CLR is successfully loaded into the host process, a new Application Domain is created... After the AppDomain is ready, Donut loads the .NET assembly and invokes the payload’s entry point.
Discord. Phemedrone extracts authentication tokens from the Discord application, enabling unauthorized access to the user's account.
"Session token and cookie theft has become the primary objective of stealer malware... When attackers steal active session cookies, MFA becomes irrelevant"; and "listings typically include browser passwords, cookies, and session tokens."
Phemedrone collects extensive system details, including hardware specs, geolocation, and operating system information, and takes screenshots.
MITRE ATT&CK Mapping ... Collection Data from Local System T1005 Wallet, Discord, Telegram, Steam data
Its capabilities extend to exploiting vulnerabilities, leveraging command and control infrastructure, and facilitating remote access.
If the key is not found, the client sends a 'sendplugin' command to the C2 server ... The C2 server then responds with the command 'savePlugin' along with a base64 encoded string containing the plugin | We observed XWorm RAT Operators execute additional malware, such as: DarkCloud Stealer ... Remcos RAT
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an associated analytic story; no specific behavior is described in the content beyond being a stealer family.
Referenced as an analytic story associated with malicious PowerShell DownloadString activity.
Associated Analytic Story ... Warzone RAT Phemedrone Stealer Prestige Ransomware Graceful Wipe Out Attack ...
A .NET information stealer that targets browser credentials, cryptocurrency wallets, Discord tokens, Telegram sessions, and Steam accounts. In this campaign it is disguised as svchost.exe and delivered via a multi-stage chain using encrypted PowerShell and the ALTERNATE.dll injector.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.