To completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are dominating it. Always remember that behind every user of the Internet there is another human like you, so if you can be kind enough to reach them and they agree, you can have a little talk. Asking things is not a crime.
Please note everything that stated on this blog has only an informational purpose. I will never promote the use of these products.
Let’s see today, a brief talk with XFILES (aka DeerStealer, a name given by researchers and later implemented in the marketing of XFILES):
The interview was made in Russian. Original answers and English translations are provided below.
How would you describe XFILES?
Коробка с инструментами для быстрого заработка
A box with tools for quick earnings
Is there a history behind the name XFILES?
Нам просто нравится тематика связанная с секретами :)
We just like the subject related to secrets :)
What makes XFILES different from other products?
У нас огромное количество инструментов: Stealer, Spyware, LNK Builder, PowerShell buillder, ClickFix scripts, Unique Crypt по низким ценам, и многое другое!
We have a huge number of tools: Stealer, Spyware, LNK Builder, PowerShell builder, ClickFix scripts, Unique Crypt at low prices, and much more!
I see XFILES is not only a product for Windows, but also offered stealer capabilities in MacOS. How this work?
В данный момент мы работаем над Spyware под macOS! Не расскажем как реализовано чтобы избежать обнаружения! Скажем только то, что он превосходит конкурентов на рынке macOS на десяток голов выше!
We are currently working on Spyware for macOS! We will not tell you how it is implemented to avoid detection! Let’s just say that it surpasses competitors in the macOS market by a dozen heads higher!
Recently it was announced the implementation of AI (Artificial Intelligence) to generate personal proxies. How this work? Is AI helpful in the infostealers development?
Всё что мы можем сказать — мы используют локальную uncensored модель! Помогает в управлении инфраструктурой, главное не давать AI слишком много обязанностей
All we can say is that we are using a local uncensored model! It helps in managing the infrastructure, the main thing is not to give AI too many responsibilities.
Stealer update referring to AIHow many people do you think have used XFILES? Approximately
Не скажем. Как видите мы имеем рекламу на многих форумах, значит откуда то деньги на это берутся, значит какое то количество клиентов мы имеем :)
We won’t tell. As you can see, we have ads on many forums, which means that the money for this comes from somewhere, which means that we have a certain number of clients :)
Since when has XFILES been working?
2021
Is the development of XFILES focused on the Stealer capabilities, or on other directions such as resident loader, HVNC, etc… ?
Сейчас активно занимаемся разработкой Spyware
We are currently actively developing Spyware.
Latest update log on Spyware // November 19th, 2025Does XFILES works on the CIS countries?
Нет и не будет.
No, and it won’t be.
How do you see the market? Is this a good time to work?
1. Раньше было лучше. Это выражение может использоватся каждый год!
2. Но на самом деле сейчас самое лучшее время, так-как криптовалюты выросли в цене, охота на них намного выгоднее чем раньше!
1. It used to be better. This expression can be used every year!
2. But in fact, now is the best time, as cryptocurrencies have increased in value, hunting for them is much more profitable than before!
On this year some of the top infostealer products have disappeared because of different reasons. Do you think the MaaS model is at risk?
Нет, но участники находящиеся за пределамии СНГ — под угрозой!
No, but the participants located outside the CIS are under threat!
What will be the future of XFILES?
«Светлым на тёмной стороне»
“Light on the dark side”
What would you say to those “information security experts” who are trying to track XFILES?
Touch grass… at least sometimes!
End
Dear reader,
Remember to check the other interviews at: g0njxa — Medium
Expect more content, if possible.
My best wishes to you ❤
@g0njxa — 2025
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.