We explain how the advanced malware DoubleFinger downloads GreetingGhoul, a stealer that preys on cryptocurrency wallets.