As a developer, I'll tell you how it works...

Wallets are a very specific new target to be stolen...(and very sma in Kb).

Keyloggers that can Make a screen shot of every click and key press (50kb)

If I send it to you, u can try it on virustotal.com (or anti antivirus software), ZERO detection.

I can say: hey! Take this miner that works better for your kind of rig....

My program is inside this "miner", and as soon as u execute it... Your computer is mine...

I mean... It can be configured to follow my instructuions (log your keys, screen shot, download wallet.dat, etc...)

But if I run it under a virtual machine in order to watch its behaviour?
No, no, no.... My program shows you a different screens when under vmware/virtual box/etc...

My firewall may block it? Hmmmm... Forget about Windows firewall, my program creates The rules for itself.

And running as a Windows service, my program have The same rights to do the same things as your firewall/antisomething have... That means I could disable it...

Remember: if The user open The door, antivirus/malware/etc.. cant do much...

You are your Bank... You r your security...

O can just give my opinion on this matter....