Laravel Stealer - Crypto Wallet Profiling (T1005)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•3

Identifies the PHP or VBS payload iterating through roaming profiles to extract high-value cryptocurrency files (wallet.dat, key4.db, .kdbx). This rule specifically looks for file access events on these sensitive files when initiated by 'cscript.exe' (VBScript host) or 'php.exe' (PHP interpreter).