Zalmoxis Stealer Hides Behind Signed Loader and Name-Based Execution

Oct 14, 2026 · Original article ↗

Summary

Researchers analyzed a signed loader that activates only under specific filenames, installs persistence, and retrieves the Zalmoxis stealer. The malware targets browser data, crypto wallets, and Chrome’s App-Bound Encryption key.

Key points

The loader exits when run as File.exe but installs or retrieves its payload when named CrashHandler.exe or Updater.exe, a behavior that can evade automated sandbox analysis.
Two builds were signed with different GlobalSign EV certificates issued to companies in Croatia and Poland; the researchers reported both certificates.
CrashHandler establishes logon persistence through a scheduled task or Startup-folder shortcut, then supervises an Updater copy using shared memory.
The loader retrieves payloads from cdn[.]simplynetworking[.]eu using signed and encrypted server replies; researchers recreated the protocol and tested it with a harmless payload in an isolated environment.
The Zalmoxis payload steals browser credentials, cookies, crypto wallets, and account tokens, and supports keylogging, screenshots, webcam access, and hidden-desktop remote control.
A bundled DLL injects into a Chromium browser process to obtain Chrome’s App-Bound Encryption key; the article says researchers did not contact the live servers or verify what they currently serve.
Defenders can look for the CrashHandler task, CrashHandler.exe, Updater.exe, Logo.png, and the Local\ZenHeartbeat shared-memory name.

Article Details

Attack Vectors: The loader changes behavior according to its filename: as CrashHandler.exe it installs itself, while as Updater.exe it contacts its server and loads a payload; under other names it exits.
Downloaders including tea.exe and updsvc.exe fetched /Updater.exe and saved it as %LOCALAPPDATA%\CrashHandler\CrashHandler.exe.
The loader establishes logon persistence with a scheduled task named CrashHandler, falling back to a Startup-folder shortcut if task creation fails.
The loader downloads an XOR-obfuscated DLL as Logo.png, unscrambles it in memory, and loads it without writing a conventional DLL file to disk.
The Zalmoxis payload steals browser credentials, cookies, crypto-wallet data, and account tokens; it also includes keylogging, clipboard access, screenshots, webcam access, and hidden-desktop remote control.
Zalmoxis places ChromiumPayloadABE.dll into a Chromium browser process to obtain Chrome's App-Bound Encryption cookie key.
Defensive Notes: Be wary of unexpected updaters or crash handlers, particularly files appearing under %LOCALAPPDATA%\CrashHandler\.
Hunt for the \CrashHandler scheduled task; CrashHandler.exe, Updater.exe, and Logo.png in the same folder; and the shared-memory name Local\ZenHeartbeat.
A Logo.png file that lacks a PNG header but becomes an MZ-format file after XOR with 0x69 is a strong signal.
The loader uses the unusual, truncated user agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.
If a signed sample appears inactive, test it under the filenames CrashHandler.exe and Updater.exe.
If infection is suspected, assume browser passwords, sessions, and wallets may be compromised; change passwords from a clean device, sign out of sessions, and move crypto funds to a new wallet.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`cdn[.]simplynetworking[.]eu`	Loader server used for check-in and payload requests.
IPV4	`45[.]152[.]149[.]66`	Hard-coded Zalmoxis server address found in the payload code; the researchers did not observe traffic to it.
SHA256	`4ee019bed7bc98e908b164c6c0ea6ecb3a9ea9a5ddeabea8fe9ae77d639548d5`	Hash of the ZalmoxisClientStub.dll payload.
SHA256	`57eec1d0ac09c29ccfba43fcd44b04d8cdccea5e5b7653278a4fa2994233861c`	Hash of Logo.png, which contains the scrambled payload.
SHA256	`8bfc78bf454a49f4a0d0a09f1d53a59bccfe47cf4405acd1557391f778dcd3ee`	Hash of ChromiumPayloadABE.dll, the embedded DLL used to obtain Chrome's cookie-protection key.
SHA256	`ad0d08d54c9bbe2309bb7a8ae92def8a04297d0238f2799764d93929b57cbd5f`	Hash of the File.exe loader signed with the YOUR CHANCE j.d.o.o. certificate.
SHA256	`e518987c6e2678fa89da4755adab11d9d01f1331b763766146b1a467522be13c`	Hash of an earlier loader build signed with the Komers Trading Company LLC certificate.