Phemedrone Stealer is an open-source .NET info-stealer first
surfaced in August 2023 at
github.com/nullixx/Phemedrone-Stealer. Public research
documented its use in a CVE-2023-36025 Windows SmartScreen
bypass campaign in January 2024, with detailed technical
analyses following. Public malware databases track the family
under win.phemedrone_stealer and list Ov3r_Stealer as an
alias. Forks include VGS Stealer and its successor Arcane
(publicly documented in March 2025).
The on-victim panel is a plain-text Information.txt with
three dashed-section headers spelled ----- Geolocation Data -----, ----- Hardware Info -----, and ----- Miscellaneous -----. Fields under each header use a column-aligned Key:
plus multi-space plus value shape. The Geolocation block ships
IP, Country (name plus alpha-2 code), City, Postal, and MAC.
The Hardware block ships Username (as <user>\<hostname>, the
reverse of the Windows USERDOMAIN\USER order), Windows name,
Hardware ID (32-hex MachineGuid hash), GPU, CPU, and RAM. The
Miscellaneous block ships Antivirus products (comma-separated
from the WMI SecurityCenter2 query), File Location (usually
C:\Users\<user>\Downloads\Build.exe), and Clipboard text.
Treat the Clipboard text field as unreliable for family
attribution: it captures whatever was on the victim clipboard
at exfil time, including coincidental strings that mention
other stealers' names.
