Suspicious Access to Cryptocurrency Wallet Files (PureLog Stealer)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•6

Detects access to sensitive cryptocurrency wallet files (e.g., wallet.dat, keystore) by processes typically associated with LOLBins (Living-off-the-land Binaries) like PowerShell, MSBuild, or non-executable utilities. This activity is indicative of credential theft or data staging for exfiltration of cryptocurrency assets.