Phemedrone
Phemedrone is an open-source C# infostealer/Trojan used to steal credentials and other sensitive data from Windows systems. The malware has been distributed mainly via Telegram and was previously available on GitHub before takedown, making it easy for threat actors to customize and rebrand; one observed campaign used a Phemedrone variant rebranded as “VGS.” It has also appeared in broader malware distribution schemes, including YouTube- and Telegram-based campaigns involving fake game cheats, software cracks, and trojanized restriction-bypass tools, and it has been listed among commonly used families alongside NJRat, XWorm, and DCRat.
Phemedrone steals passwords, cookies, credit card data, and other information from Chromium-based and Firefox/Gecko-based browsers. It also targets numerous browser extensions, including cryptocurrency wallets and password managers such as MetaMask, Trust Wallet, Coinbase Wallet, Phantom Wallet, Bitwarden, LastPass, KeePassXC, Ledger Live, Trezor, Google Authenticator, Microsoft Authenticator, Authy, and Duo Mobile. Additional theft capabilities include Discord tokens (including extraction from LevelDB data using the regex string "dQw4w9WgXcQdQw4w9WgXcQ:[^"]*"), cryptowallet data including wallet.dat files, FileZilla recentservers.xml and sitemanager.xml, Steam ssfn files and config.vdf, Telegram tdata and related registry data, VPN-related data from OpenVPN, ProtonVPN, and SurfShark, and files from Desktop and My Documents via a configurable FileGrabber.
The malware parses stolen passwords and cookies on the victim machine and categorizes them with tags to help operators identify valuable logs. Its default tagging includes Russian-focused financial and service targets such as Tinkoff, Sberbank, YooMoney, and FunPay. It generates an Information.txt file containing victim system information, counts of stolen passwords and cookies, and tag results, and it automatically captures a screenshot after installation for exfiltration. Phemedrone can also generate random user agents for communications.
Observed system-discovery behavior includes geolocation lookup via hxxp://ip-api[.]com/json/?fields=11827 in its GetGeoInformation() method. The malware supports multiple exfiltration modes: gate sender, panel sender, and Telegram sender; the Telegram sender can encrypt logs with AES and RSA before transmission. Anti-analysis features include anti-debugger checks, anti-VM checks, a mutex check, and an optional CIS keyboard-language exclusion that is disabled by default in the builder.
Phemedrone has also been reported among malware families that successfully bypassed App-Bound Encryption. Related variants exist, including Mephedrone. SpyCloud recaptured Phemedrone logs globally, with the largest observed shares in the United States, the Netherlands, and the Republic of Korea, while Russia accounted for a smaller share despite the malware’s Russia-focused tagging.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Others include StealC, RedLine, Odebug and other Phemedrone variants, and NodeJS loaders and downloaders.
Techniques & procedures
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
4 techniques
Stealth
They started distributing malware under the guise of restriction bypass programs and injecting malicious code into existing programs.
Phemedrone contains several anti-analysis checks which can be enabled during the build phase of the malware. If any of the checks described below are successful, Phemedrone exits.
Defense Impairment
1 technique
Defense Impairment
Credential Access
3 techniques
Credential Access
Phemedrone will target Discord tokens by accessing the Discord leveldb database, stored on a victim’s computer. It will then regex for “dQw4w9WgXcQdQw4w9WgXcQ:[^\”]*”, which it will use to extract the victim’s Discord token for authentication purposes.
Discovery
4 techniques
Discovery
Phemedrone contains several anti-analysis checks which can be enabled during the build phase of the malware. If any of the checks described below are successful, Phemedrone exits.
Anti-VM Phemedrone’s anti-VM check checks the victim’s computer for the following virtual machine (VM) strings, which indicate that Phemedrone is being run in a VM.
Collection
3 techniques
Collection
Phemedrone also includes a basic filegrabber, which will iterate through My Documents and Desktop and steal all files based on config supplied max file size and directory depth.
Command and Control
2 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Stealer malware that gathers victim network and geolocation information by querying external IP-lookup services such as ip-api.com.
A named malware family (and variants) distributed through malicious YouTube videos/links in the “YouTube Ghost Network” operation; specific functionality is not described in the provided content.
Identified as one of multiple malware families reported to have successfully bypassed App-Bound Encryption.
Open-source C# infostealer distributed mainly via Telegram. It steals browser data, cookies, passwords, credit cards, cryptowallet data, Discord tokens, files, FileZilla data, screenshots, Steam and Telegram session data, and VPN configuration data; it also supports tagging stolen data, anti-analysis checks, multiple exfiltration methods, and AES+RSA-encrypted Telegram exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.