Malware

XFiles Reborn

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

malicious .docx

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

The shellcode itself is another downloader from the same C2 that will load and execute the XFiles Reborn stealer sample.

Stealth

1 technique

T1564.001Hidden Files and DirectoriesEvidence1

XFiles Reborn creates its working directory in the same path in which it is running, which in our case is the %APPDATA% directory.

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence1

It pursues Discord and Telegram credentials, browsing information, such as cookies, passwords and history, FTP clients credentials and, of course, crypto wallets.

T1555Credentials from Password StoresEvidence1

It pursues Discord and Telegram credentials, browsing information, such as cookies, passwords and history, FTP clients credentials and, of course, crypto wallets.

T1555.003Credentials from Web BrowsersEvidence1

It pursues Discord and Telegram credentials, browsing information, such as cookies, passwords and history, FTP clients credentials and, of course, crypto wallets.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

The PCInfo.txt file, which contains the system information of the victim’s machine, is also created within the working directory along with the captured screenshot.

Collection

3 techniques

T1005Data from Local SystemEvidence1

Finally, in some cases, the stealer looks for particular files such as .txt and .pdf and gathers screenshots of the victim’s machine.

T1074Data StagedEvidence1

The working directory consists of two directories: Grabber – Contains all files stolen and crypto-wallets. Browsers – Contains all browsing information divided into browser directories.

T1113Screen CaptureEvidence1

Finally, in some cases, the stealer looks for particular files such as .txt and .pdf and gathers screenshots of the victim’s machine.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

The shellcode itself is another downloader from the same C2 that will load and execute the XFiles Reborn stealer sample.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyberintNews

Jul 3, 2022

XFiles Stealer Campaign Abusing Follina

An information stealer that collects Discord and Telegram credentials, browser cookies, passwords and history, FTP credentials, crypto wallets, stored credit card information, selected .txt and .pdf files, screenshots, and system information from the victim machine.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

XFiles Reborn

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

malicious .docx

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

The shellcode itself is another downloader from the same C2 that will load and execute the XFiles Reborn stealer sample.

Stealth

1 technique

T1564.001Hidden Files and DirectoriesEvidence1

XFiles Reborn creates its working directory in the same path in which it is running, which in our case is the %APPDATA% directory.

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence1

It pursues Discord and Telegram credentials, browsing information, such as cookies, passwords and history, FTP clients credentials and, of course, crypto wallets.

T1555Credentials from Password StoresEvidence1

It pursues Discord and Telegram credentials, browsing information, such as cookies, passwords and history, FTP clients credentials and, of course, crypto wallets.

T1555.003Credentials from Web BrowsersEvidence1

It pursues Discord and Telegram credentials, browsing information, such as cookies, passwords and history, FTP clients credentials and, of course, crypto wallets.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

The PCInfo.txt file, which contains the system information of the victim’s machine, is also created within the working directory along with the captured screenshot.

Collection

3 techniques

T1005Data from Local SystemEvidence1

Finally, in some cases, the stealer looks for particular files such as .txt and .pdf and gathers screenshots of the victim’s machine.

T1074Data StagedEvidence1

The working directory consists of two directories: Grabber – Contains all files stolen and crypto-wallets. Browsers – Contains all browsing information divided into browser directories.

T1113Screen CaptureEvidence1

Finally, in some cases, the stealer looks for particular files such as .txt and .pdf and gathers screenshots of the victim’s machine.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

The shellcode itself is another downloader from the same C2 that will load and execute the XFiles Reborn stealer sample.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyberintNews

Jul 3, 2022

XFiles Stealer Campaign Abusing Follina

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.