Phemedrone Stealer

Phemedrone Stealer is a type of malware that infiltrates systems to extract sensitive data. It has been found to have similar functionalities to another malware known as Styx Stealer, as evidenced by the country checks, anti-analysis function, and anti-VM checks in both malwares, according to Figures 32, 30, and 31 respectively. A comparative analysis of their report headers (Figure 8) revealed that the core functionality of Styx Stealer was entirely copied from Phemedrone Stealer. However, there are distinct differences, such as the tagging feature present in the newer version of Phemedrone Stealer which is absent in Styx Stealer (Figure 33). A version of Phemedrone Stealer dated September 1, 2023, showcased features not found in the analyzed sample of Styx Stealer. This led to the conclusion that the code for Styx Stealer was based on an earlier version of Phemedrone Stealer released before September 2023. The latest versions of Phemedrone Stealer have advanced capabilities, including a feature that allows it to send data to Telegram and encrypt it with a unique key for each campaign. In addition, a document was discovered that was structured similarly to Phemedrone Stealer but had a different header containing the identifier "Styx Stealer". This further emphasizes the connection between the two types of malware and suggests that they may be part of related or coordinated malicious activities. The ongoing investigation and comparison of these two malware types will provide further insights into their functionalities and potential countermeasures.