Uphero

“A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer… operators behind 7zip[.]com distributed a trojanized installer via a lookalike domain”

“A fake 7-Zip website is distributing a trojanized installer… The malicious copy also contains the 7-Zip program… However, the installer drops three malicious files…”

“Following a YouTube tutorial for a new build, they were instructed to download 7‑Zip from 7zip[.]com, unaware that the legitimate project is hosted exclusively at 7-zip.org.”

The malware incorporates multiple layers of sandbox and analysis evasion: Runtime API resolution and PEB inspection

A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer that silently converts victims’ machines into residential proxy nodes.

Both Uphero.exe and hero.exe are registered as auto‑start Windows services running under System privileges, ensuring execution on every boot.

Both Uphero.exe and hero.exe are registered as auto‑start Windows services running under System privileges, ensuring execution on every boot.

The operators behind 7zip[.]com distributed a trojanized installer via a lookalike domain, delivering a functional copy of 7‑Zip File Manager alongside a concealed malware payload.

The malware incorporates multiple layers of sandbox and analysis evasion: Virtual machine detection targeting VMware, VirtualBox, QEMU, and Parallels

The malware incorporates multiple layers of sandbox and analysis evasion: Anti‑debugging checks and suspicious debugger DLL loading

“The installer is Authenticode‑signed using a now‑revoked certificate issued to Jozeal Network Technology Co., Limited, lending it superficial legitimacy.”

The malware incorporates multiple layers of sandbox and analysis evasion: Process enumeration, registry probing, and environment inspection

“enumerates… network configuration… communicates with iplogger[.]org via a dedicated reporting endpoint”

The malware incorporates multiple layers of sandbox and analysis evasion: Process enumeration, registry probing, and environment inspection

“the malware enumerates system characteristics including hardware identifiers, memory size, CPU count, disk attributes, and network configuration.”

The malware incorporates multiple layers of sandbox and analysis evasion: Virtual machine detection targeting VMware, VirtualBox, QEMU, and Parallels

The malware incorporates multiple layers of sandbox and analysis evasion: Anti‑debugging checks and suspicious debugger DLL loading

“The infected host is enrolled as a residential proxy node, allowing third parties to route traffic through the victim’s IP address.”

“The infected host is enrolled as a residential proxy node, allowing third parties to route traffic through the victim’s IP address.”

In their Reddit post, the user described installing the file first on a laptop and later transferring it via USB to a newly built desktop.

Memory analysis uncovered a large pool of hardcoded command-and-control domains using hero and smshero naming conventions.

Active resolution during sandbox execution showed traffic routed through Cloudflare infrastructure with TLS‑encrypted HTTPS sessions.

The malware invokes netsh to remove existing rules and create new inbound and outbound allow rules for its binaries.