Analysis & Comparison of X-FILES Stealer Evolution

Zscaler ThreatLabz analyzed multiple variants of the X-FILES infostealer (March 2021–June 2022), documenting evolving features such as expanded system and wallet data collection, directory-crawling for browser data, FTP (FileZilla/WinSCP) theft, base64 string obfuscation, and JSON-based C2 exfiltration. The report outlines phishing and Follina-based delivery chains, provides IoCs (domains, MD5s, filenames), compares variant capabilities, and maps observed behaviors to MITRE ATT&CK.