A signed “crash handler” that only wakes up under the right name

About this post

Thanks to MalwareHunterTeam for flagging this certificate signer. This analysis and write-up were produced by Claude (Opus 5.5), working as an agent in Claude Code on a REMnux analysis VM. Tools used: Malcat, capa, FLOSS, Python (pefile, capstone, pycryptodome), osslsigncode, a sandboxed Wine environment with a home-made fake server, ANY.RUN and VirusTotal.

TL;DR

File.exe is a properly signed Windows program that does absolutely nothing when you run it under that name. It closes in 14 milliseconds, and a public sandbox scored it 0 out of 100. Rename it to CrashHandler.exe, though, and it installs itself, keeps a second copy of itself running, and asks its server for a payload. The payload we recovered is a home-grown stealer and remote-control tool its author calls Zalmoxis. It takes browser passwords, cookies and crypto wallets, and lets the operator use the PC on a hidden desktop.

• Signed: two different EV certificates over two months, issued to “YOUR CHANCE j.d.o.o.” (Croatia) and “Komers Trading Company LLC” (Poland).
• Name trick: the program picks its job from its own file name (CrashHandler installs, Updater downloads). Anything else exits.
• Careful server talk: every reply from the server is signed and encrypted, so researchers can’t easily fake one. We rebuilt the scheme and faked one anyway.
• Hidden payload: the payload sits on disk as Logo.png, but it isn’t a picture. It’s a DLL with every byte scrambled.
• Three stages: loader → Zalmoxis stealer/remote-control DLL → a Chrome add-on that steals the browser’s newest cookie-protection key.

But it’s signed!

Code signing is a digital seal: it says who published a program and proves the file hasn’t been changed since. Windows and SmartScreen trust signed files more, so malware authors buy certificates, often in the name of small, unrelated companies. We have reported more than 2,500 signed malware samples, and this is one of the most common patterns we see.

This file carries a valid Extended Validation (EV) signature from YOUR CHANCE j.d.o.o., a company registered in Zagreb, issued by GlobalSign in late August 2026 and used on 19 September. An earlier build of the same program, from August, is signed by Komers Trading Company LLC in Poland, also through GlobalSign. The code, the server and the secret keys are identical. Only the signature changed, which is what you’d expect when a burned certificate gets swapped for a fresh one. Both certificates have been reported to the CA and added to the CertGraveyard.

The name is the password

Most programs don’t care what their file is called. This one reads its own file name first, and then:

• CrashHandler… → it installs itself and acts as a babysitter.
• Updater… → it talks to the server and loads the payload.
• Anything else → it quits immediately.

That’s why the ANY.RUN sandbox saw nothing: it ran the file as File.exe, and the program exited 14 milliseconds later. Antivirus engines aren’t much better: 2 of 72 flagged it on VirusTotal. It’s a cheap trick, but it beats any analysis that only runs the sample under the name it arrived with.

In the wild the name comes from a small downloader. VirusTotal shows several of them (tea.exe, updsvc.exe) fetching /Updater.exe from the same server and saving it as %LOCALAPPDATA%\CrashHandler\CrashHandler.exe. Those runs received the August build. We don’t know how this particular copy was delivered.

A babysitter and a heartbeat

As CrashHandler.exe, the program creates a scheduled task called CrashHandler that starts it at every logon. If that fails, it falls back to a shortcut in the Startup folder. It then copies itself next to itself as Updater.exe and starts the copy.

The two copies keep in touch through a small piece of shared memory named Local\ZenHeartbeat. Think of it as a pulse monitor: the worker is expected to update a timestamp regularly. If the worker crashes, or its “pulse” stops for 60 seconds, the babysitter kills it and starts a fresh one. The Zalmoxis payload contains the same ZenHeartbeat name and magic value, so it was clearly built to keep that pulse going.

A server conversation you can’t easily fake

The Updater copy first waits until Windows reports an internet connection. It then asks cdn[.]simplynetworking[.]eu (behind Cloudflare) two questions over HTTPS:

• /api/v1/runtime/check: “am I still active?”
• /api/v1/runtime/payload: “give me the payload, unless I already have the version with this hash.”

Each request carries a random 32-byte number (a “nonce”) and a victim ID. The ID is a hash of the Windows user’s security ID plus a campaign string, sn-e6e7eb53e7bc1133fa1bd748.

The answers are where it gets careful. The server replies with three fields, and the program mixes its own nonce, the server’s random value and a secret key built into the binary to derive a one-time key. It then checks a signature (an HMAC, a kind of tamper-proof checksum) and only then decrypts the reply. Without the built-in key, a researcher can’t send the program a fake “yes, you’re active” answer.

We recovered the key and rebuilt the whole scheme, then ran the real program inside an isolated Wine sandbox with no internet. A small fake server we wrote stood in for the real one. The program accepted our replies, downloaded our harmless test DLL, and saved it exactly as it would the real payload. That’s about as strong a confirmation as you can get that we understood the protocol correctly.

Logo.png is not a picture

The payload is stored next to the program as Logo.png. Every byte is XORed with 0x69, a simple scramble that hides the MZ header every Windows program starts with, so a casual look at the folder finds no second program. On the next run the loader compares the file’s hash with what the server wants. If it matches, the file is reused; otherwise it’s downloaded again.

To run the payload, the loader unscrambles it in memory and loads it with MemoryModule, an open-source library that loads a DLL without ever writing a normal DLL file to disk. The loader thread then simply sleeps forever.

Meet Zalmoxis

We never contacted the attackers’ server. VirusTotal had seen an older copy of this loader run in its own sandbox in early October, and that run dropped a 3 MB Logo.png. Unscrambling it with the loader’s own XOR byte gives a valid Windows DLL, compiled the same day. It’s built around the loader’s heartbeat, which makes us confident it’s the payload this campaign serves. The server could hand out different payloads to different victims, and we didn’t check what it serves today.

The DLL names itself ZalmoxisClientStub.dll and writes crash logs to a zalmoxis_crashes folder. It doesn’t match any malware family we know. AV engines call it “Lumma”, but we found nothing Lumma-specific in it. Here’s what it can do:

• Steal browser data: saved passwords and cookies from Chrome, Edge, Brave, Avast Browser and Firefox.
• Steal crypto wallets: Exodus, Electrum, Coinomi, Atomic, Guarda, Ethereum keystores, Zcash, Tonkeeper and a long list of browser wallet extensions.
• Take other accounts: Discord and Roblox tokens.
• Watch the user: a keylogger, clipboard reading and writing, screenshots and the webcam.
• Hidden desktop remote control (HVNC): the operator gets a second, invisible Windows desktop with its own Explorer. They can click and type there, for example in your logged-in browser, without you seeing anything on screen.
• Housekeeping: a public-IP check, a local proxy component, and commands to shut down or reboot the PC.

Its hard-coded server is 45[.]152[.]149[.]66 on port 6969, hosted with “1337 Services GmbH”. We found the address in the code that builds the connection; we never saw traffic to it.

A key thief for Chrome

Zalmoxis carries one more DLL inside itself, encrypted with ChaCha20, and we decrypted it with the key stored next to it. It’s called ChromiumPayloadABE.dll, and it targets Chrome’s “App-Bound Encryption”. That’s a 2024 protection that ties the cookie key to the Chrome program itself, so malware outside the browser can’t simply read it. The workaround is to get inside the browser: Zalmoxis puts this DLL into a Chromium browser process, where it asks for the key “as Chrome”, and hands it back over a named pipe. This third DLL had never been uploaded to VirusTotal.

What we couldn’t reach

• The live server: we didn’t contact cdn[.]simplynetworking[.]eu or the Zalmoxis server, so we can’t say what they serve right now.
• Zalmoxis’s command set: the stealer and HVNC features are clear from the code, but we didn’t reverse the exact network protocol or the list of commands, and no recorded traffic exists to check against.
• The local proxy: stage 2 contains a proxy component on 127[.]0[.]0[.]1:13005. Whether it turns the victim into a proxy for the attacker is still open.

What should you do?

For everyone:

• A valid signature tells you who paid for a certificate, not whether the program is safe.
• Be wary of “updaters” and “crash handlers” you didn’t knowingly install, especially ones that appear under %LOCALAPPDATA%\CrashHandler\.
• If you think you ran something like this, assume your browser passwords, sessions and wallets are compromised. Change passwords from a clean device, sign out of all sessions, and move crypto funds to a new wallet.

For defenders:

• Hunt for the scheduled task \CrashHandler, the files CrashHandler.exe, Updater.exe and Logo.png in the same folder, and the shared-memory name Local\ZenHeartbeat.
• A Logo.png that doesn’t start with the PNG header but turns into MZ when XORed with 0x69 is a strong signal.
• The loader’s user agent is an unusual, cut-off string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, with nothing after it.
• When a signed sample “does nothing” in a sandbox, try the names it expects. Here, CrashHandler.exe or Updater.exe.

Indicators of compromise

Wrapping up

This isn’t an exotic piece of malware, but it’s built with care. Signed binaries rotate between companies, a name check quietly defeats sandboxes, server replies can’t be forged, the payload is disguised as an image, and there’s a separate tool just for Chrome’s newest protection. Each step on its own is simple. Together they kept this campaign almost invisible to automated analysis.

If you have more samples from this cluster, or have seen Zalmoxis elsewhere, we’d love to hear about it.