According to the article this malware also does keylogging. So, presumably, they'll have the vault password as well.