Crypto Wallet File Access by Suspicious Process - DeepLoad/DeerStealer

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

This rule detects attempts by unsigned or suspicious processes (often residing in temporary directories) to access sensitive cryptocurrency wallet files such as 'wallet.dat', keystore JSON files, and files containing recovery seed phrases. This behavior is indicative of credential theft commonly associated with infostealer campaigns like DeepLoad and DeerStealer.