Vidar - Cryptocurrency Wallet Access (T1555)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Identifies when the AutoIt3.exe process accesses cryptocurrency wallet files or directories such as MetaMask, Exodus, Coinomi, or wallet.dat. This behavior is indicative of information stealer malware like Vidar attempting to exfiltrate sensitive cryptocurrency data.