Xfiles - Stealer

[luciferxfiles]

Update 3.9.0

Changed the interface of the Extension Grabber, now it has become much more convenient: the ability to import prepared extensions in "CSV" and "Simple" format as shown in the screenshot. It is now possible to import a list of extensions recommended by us into your config with 1 click.
Extension names will now be shown in the archive with the log (as in the screenshot)
Improved localization to EN, RU, ES.
Updated proxy servers (every 24 hours.)
Cleaning the crypto stub (every 24 hours.)
----
We are already working on a new major update! Personal proxies, Hidden VNC and much more!

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - Write your telegram nickname in PM right away
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Update 3.10.0

Добавили расшифровку новых Google Chrome куков!

Почти бесшумное расшифровка новых куков, используется обход админ прав, билд не помещается в папку с установленным хромом как во многих других стиллерах!
Обновили Панель.
Оптимизировали билд, минимизировали лишнюю сетевую активность со стороны билда.

Поддержка расшифровки только для новых билдов, для этого в старом конфиге необходимо нажать на кнопку перехода на новую версию и создать билд.

Расшифрока новых Brave Куков так же имеется.
Благодаря разшифровке, стиллер собирает cvc так же.
Обновили прокладки (каждые 24 часа.)
Подписка Тестер больше недоступна.
Улучшили стаб крипта - стоимость подписки - 250$ в месяц.

Update 3.10.0

Added decryption of new Google Chrome cookies!

Almost silent decryption of new cookies, bypass of admin rights is used, the build does not moved into the folder with the installed Google Chrome as in many other stealers!
Updated the Panel
Optimized the build, minimized unnecessary network activity from the build.

Support for decryption only for new builds, for this in the old config you need to click on the button to switch to the new version and create a build.

Decryption of new Brave Cookies is also available.
Thanks to decryption, the stealer collects cvc in the same way.
Updated proxies (every 24 hours.)
The Tester subscription is no longer available.
Improved crypt stub - subscription cost is $ 250 per month.

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - Write your telegram nickname in PM right away
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Update 3.11.0

Небольшое обновление, добавили маркеры логов по умолчанию, для этого необходимо перейти в Управление командой > Маркеры логов (в самом низу) > Нажать на синюю кнопку
Теперь мы в matrix https://matrix.to/#/@luciferxfiles:matrix.org

Update 3.11.0

A small update, added log markers by default, to do this you need to go to Team Management > Log Markers (at the very bottom) > Click on the blue button
Now we are in matrix https://matrix.to/#/@luciferxfiles:matrix.org

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - Write your telegram nickname in PM right away
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Update 3.12.0

Небольшое обновление, панель управления созданных билдов улучшена, появилась возможность массового удаления билдов. Стоит отметить, что логи полученные от удаленные билдов всё равно будут поступать в вашу панель!


Update 3.12.0

A small update, the control panel of created builds has been improved, the ability to mass delete builds has appeared. It is worth noting that the logs received from deleted builds will still be sent to your panel!

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - Write your telegram nickname in PM right away
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Update

Мы обновили стаб, теперь мы также собираем Почтовые клиенты - Outlook (New, Classic, Office 2016 с дешифровкой пароля), Thunderbird.
Инструменты удаленного контроля - AnyDesk, Windows RDP (также дешифровываем пароль от него если он присутствует).

Update

We have updated the stub, now we also collect Mail clients - Outlook (New, Classic, Office 2016 with decryption of the president), Thunderbird.
Remote control tools - AnyDesk, Windows RDP (we also decrypt the password from it, if it is present)

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - Write your telegram nickname in PM right away
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Update 3.13.0

Небольшое но важное обновление! Google Chrome в версии v130 немного изменил метод шифрования, поэтому мы изменили алгоритм дешифровки. Ребилд НЕ ТРЕБУЕТСЯ, затронута только наша серверная часть. У кого попались сломанные (с иероглифами и т.д.) куки из за новой версии хрома, напишите в поддержу - мы поможем восстановить вам эти куки!
Теперь при создании конфига билда, конфиг создается с новой версией (v5) автоматически.
Убраны лаги в интерфейсе управления хром расширениями (только для v5).

Update 3.13.0

A small but important update! Google Chrome in version v130 slightly changed the encryption method, so we changed the decryption algorithm. Rebuild IS NOT REQUIRED, only our server part is affected. If you have broken (with hieroglyphs, etc.) cookies due to the new version of Chrome, write to support - we will help you restore these cookies!
Now when creating a build config, the config is created with a new version (v5) automatically.
Removed lags in the chrome extensions management interface (only for v5).

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - Write your telegram nickname in PM right away
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Дорогие участники проекта , в связи с последними новостями в телеграмме , рекомендуем подписаться на Element мессенджер чтобы оставаться всегда на связи.

Dear project participants, in connection with the latest news in telegram, we recommend subscribing to Element messenger to always stay in touch.

XFiles | DevBlog | DeerStealer
https://matrix.to/#/#XFILESDevblog:matrix.org
XFiles - Public Chat
https://matrix.to/#/#XFilesPublicChat:matrix.org
Support
https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Update

Microsoft Edge изменили шифрование куков с версии v130, для дешифровки куков нового Microsoft Edge необходимо сделать ребилд, стоит отметить что отстук со старых билдов по прежнему будет.

Update

Microsoft Edge has changed the encryption of Cookies since version v130, to decrypt Cookies of the new Microsoft Edge you need to do a rebuild, it is worth noting that there will still be a knockback from old builds.

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - Write your telegram nickname in PM right away
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Телеграм аккаунт и чаты снесены Для общение с нами в тг - пишите в лс

Telegram account and chats have been removed. To communicate with us in TG, write to PM
https://usrlnk.io/XFiles

 

[luciferxfiles]

Update 3.14.0

Уникальность стаба повышена до ~80%
В режиме BETA новый обход защиты браузеров. В течении двух дней он перейдет в стадию релиза.
Добавили возможность выполнения лоадера только если у жертвы установлен определенный софт.

До конца месяца планируется выпустить Hidden VNC с удобным управлением.
До конца месяца планируется выпустить MacOS (alpha)
До конца месяца планируется добавить личные прокладки.

Update 3.14.0

Stab uniqueness increased to ~80%
New browser protection bypass in BETA mode. It will go into release stage in two days.
Added the ability to run the loader only if the victim has certain software installed.

Hidden VNC with convenient control is planned to be released by the end of the month.
MacOS (alpha) is planned to be released by the end of the month
Personal proxies is planned to be added by the end of the month.

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - https://usrlnk.io/XFiles
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Дорогие друзья! Поздравляем вас с Новым 2025 годом!
Для действующих клиентов мы добавили 4 дня подписки и при релизе HVNC (Скрытый VNC) - бесплатный 72 часовой тест.
Для новых клиентов при покупке Подписки Премиум или Вор мы добавляем 14 дней в подарок. Акция действует с 25 до 3 января.

Dear friends! Happy New Year 2025!
For existing customers, we have added a 4-day subscription and, when HVNC (Hidden VNC) is released, a free 72-hour trial version.
For new customers, when purchasing a Premium or Thief Subscription, we add 14 days as a gift. The promotion is valid from January 25 to January 3.

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - https://usrlnk.io/XFiles
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Spoiler: Update 3.18.0

HiddenVNC​

♕Native stab, written in the C programming language, stab written from scratch.

System calls are used wherever possible, in other cases WinAPI is used, no third-party libraries are used or required.

♕ Work with bots occurs through a responsive Web interface, the panel allows you to work with several bots simultaneously.

Communication between bots and the server occurs via the HTTP protocol using its own encryption, bots do not know the real IP of the server to which they will connect, they will connect to "proxy domains", which increases survivability.

♕ Gasket system (proxy) - we do not show the IP where the connection from the bot to your server occurs, due to this, the survivability of the bot increases.

♕ Personal server - for each Spyware client, we set up a personal server, bots will connect to your server via gaskets.

♕ Convenient control panel in the Browser - the ability to manage several bots simultaneously from one or several accounts (teamwork), support for Light and Dark interface themes.

♕ At the moment, several modules have been created:

• Basic
• View and stop Windows processes
• Loader: launch commands via Shell Execute for the bot
• Download And Execute: download and run files for the bot, HTTP and HTTPS links are supported.
• Mass disabling of bots
• Mass deletion of bots
• HVNC (Hidden VNC, Hidden session similar to VNC)
• Hidden screen for controlling the victim's device allows you to work at a speed of up to 30 FPS (depending on their and your connection stability)
• Ability to set the image quality
• The same keyboard layout as the selected bot is available

Clipper​

- Clipper crypto wallet substitution, currently we support substitution
Bitcoin Legacy and P2SH Addresses
Bitcoin Bech32 Addresses
Monero (XMR) Standard addresses
Stellar (XLM)
Ripple (XRP)
Litecoin (Legacy) (LTC)
Litecoin (Bech32) (LTC)
Neocoin (NEO)
Bitcoin Cash (Legacy and New)
Dashcoin (DASH)
Dogecoin (DOGE)
Binance chain (BEP2)
Ethereum (ETH) (ERC-20) or (BEP-20)
TRON (TRX) or (TRC-20)
Zcash (ZEC)
We can add other protocols (and not only) at your request

Keylogger Live​

- Full logging of bot keystrokes on any layout, including key modifiers such as Ctrl, Shift

• Ability to set the frequency of receiving logs from the bot
• Tasks (under development)
• Ability to create tasks for bots based on rules
• Other modules can be implemented at the request of the client

♕ Spyware installation for you takes up to 2 days, but usually it happens in 1.

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - https://usrlnk.io/XFiles
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Update 3.19.0

LNK Builder is out and available for Professional subscriptions!​

To use it, go to the Utils tab and click ".lnk Builder"! Use it!​

The Builder has 3 modes:​

Execute script​

Upload and execute script​

Upload and execute files​

Our LNK Builder also has a powerful obfuscator that you can apply to any of the selected methods!​

We currently only allow PowerShell scripts to be executed! We are planning to implement CMD command execution instead of PowerShell!!​

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - https://usrlnk.io/XFiles
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Update 3.20.0 ​

- Improved payload delivery methods. Now we have HTML Builder.​

- Added new HTML Win+R scripts​

- LNK Builder - Now you can change the shortcut icon automatically!​

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - https://usrlnk.io/XFiles
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

Update 3.20.1 ​

Changes:

• FIX when Bot's doesnt save important protocol information
• FIX Bot's reconnections, bots now live without reconnection minimum 1 hour, where previously it can reconnect every 2 minutes.
• FIX Spyware permissions, owners of Team's may need to set permissions again for their Team Members
• FEATURE Live Keylogger logs can be saved using Download button.

Now we collect all possible User-Agents for Chromium based browsers (Google Chrome, Microsoft Edge, Brave etc)
If User-Agent is possible to generate for found profiles, then you will see User-Agents.txt in the log!

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - https://usrlnk.io/XFiles
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org

 

[luciferxfiles]

​

Update​

​

Spyware changes​

• Fixed HVNC crash​

• Added viewing behind the user's screen in BETA mode​

• Added file manager in BETA mode​

• Added buttons for quick victim management​

• Moved the "Clipper" config to another tab​

• Added "Clipper" protocols Solana, Cardano, Sui, Ton.​

=====================================================================
Support

PM of this forum
TOX - C96EA8DFB780D9053728816F20901315F6284CB73B735559100696FB30B31364CE0AD357E634
Jabber - [email protected]
Telegram - https://usrlnk.io/XFiles
Matrix - https://matrix.to/#/@luciferxfiles:matrix.org