MalwareExploits 1 CVE

X-FILES

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2022-30190FollinaExploited in the wild

Recently, it has been seen that the threat actors are now exploiting the Follina vulnerability to deliver X-FILES stealer. | Zscaler’s ThreatLabz threat research team recently has spotted a new variant of the emerging X-FILES infostealer attack with enhanced features to exfiltrate sensitive information.

via zscaler threat labzzscaler.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1189 Drive-by Compromise

T1566PhishingEvidence1

We have observed that the malware is mostly coming from phishing domains hosted on Russian IPs.

Execution

2 techniques

T1047Windows Management InstrumentationEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1047 Windows Management Instrumentation

T1203Exploitation for Client ExecutionEvidence1

Recently, it has been seen that the threat actors are now exploiting the Follina vulnerability to deliver X-FILES stealer.

Stealth

1 technique

T1140Deobfuscate/Decode Files or InformationEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1140 Deobfuscate/Decode Files or Information

Credential Access

2 techniques

T1003OS Credential DumpingEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1003 OS Credential Dumping

T1552.002Credentials in RegistryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1552.002 Credentials in Registry

Discovery

4 techniques

T1018Remote System DiscoveryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1018 Remote System Discovery

T1082System Information DiscoveryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1082 System Information Discovery

T1083File and Directory DiscoveryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1083 File and Directory Discovery

T1518.001Security Software DiscoveryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1518.001 Security Software Discovery

Collection

1 technique

T1005Data from Local SystemEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1005 Data from Local System

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

Changes in C2 patterns are also observed.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

After performing stealing activities, the malware then exfiltrates data in JSON format to its embedded C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.md5●●●●●●●●●●●●View more in app9 months ago

ip.v4●●●●●●●●●●●●View more in app9 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

zscaler threat labzNews

Jan 1, 2026

Analysis & Comparison of X-FILES Stealer Evolution | Zscaler

An infostealer written in C# that steals and exfiltrates sensitive information including browser credentials, financial data, crypto wallet data, FTP credentials, Telegram data, Steam information, Discord tokens, screenshots, and system information. Later variants added broader collection, base64-obfuscated strings, JSON-based exfiltration, and delivery via phishing sites and exploitation of Follina.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

X-FILES

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2022-30190FollinaExploited in the wild

via zscaler threat labzzscaler.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1189 Drive-by Compromise

T1566PhishingEvidence1

We have observed that the malware is mostly coming from phishing domains hosted on Russian IPs.

Execution

2 techniques

T1047Windows Management InstrumentationEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1047 Windows Management Instrumentation

T1203Exploitation for Client ExecutionEvidence1

Recently, it has been seen that the threat actors are now exploiting the Follina vulnerability to deliver X-FILES stealer.

Stealth

1 technique

T1140Deobfuscate/Decode Files or InformationEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1140 Deobfuscate/Decode Files or Information

Credential Access

2 techniques

T1003OS Credential DumpingEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1003 OS Credential Dumping

T1552.002Credentials in RegistryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1552.002 Credentials in Registry

Discovery

4 techniques

T1018Remote System DiscoveryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1018 Remote System Discovery

T1082System Information DiscoveryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1082 System Information Discovery

T1083File and Directory DiscoveryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1083 File and Directory Discovery

T1518.001Security Software DiscoveryEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1518.001 Security Software Discovery

Collection

1 technique

T1005Data from Local SystemEvidence1

MITRE ATT&CK AND TTP Mapping ID Tactic T1005 Data from Local System

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

Changes in C2 patterns are also observed.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

After performing stealing activities, the malware then exfiltrates data in JSON format to its embedded C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.md5●●●●●●●●●●●●View more in app9 months ago

ip.v4●●●●●●●●●●●●View more in app9 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

zscaler threat labzNews

Jan 1, 2026

Analysis & Comparison of X-FILES Stealer Evolution | Zscaler

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.