Loading malware…
Hero is Windows residential proxyware deployed through trojanized software installers distributed from a typosquatted imitation of the 7-Zip download site. The installer retains functional 7-Zip software while installing a Go-based proxy agent, a service/update-management component, and a supporting library. It persists as automatically started Windows services running under SYSTEM privileges and modifies Windows Firewall rules to permit its communications. Hero profiles infected systems for hardware, memory, processor, storage, and network information, then transmits host metadata externally. The proxy agent obtains configuration from rotating command-and-control infrastructure, uses DNS-over-HTTPS and encrypted web traffic, and establishes outbound proxy sessions over non-standard ports. Its primary purpose is to enroll compromised Windows systems as residential-proxy exit nodes, allowing third parties to route traffic through victims' IP addresses. The malware also incorporates virtualization and debugger checks, process and environment inspection, runtime API resolution, and encoded control communications to hinder analysis and detection.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
“A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer… operators behind 7zip[.]com distributed a trojanized installer via a lookalike domain”
“Following a YouTube tutorial for a new build, they were instructed to download 7‑Zip from 7zip[.]com, unaware that the legitimate project is hosted exclusively at 7-zip.org.”
The malware incorporates multiple layers of sandbox and analysis evasion: Runtime API resolution and PEB inspection
A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer that silently converts victims’ machines into residential proxy nodes.
Both Uphero.exe and hero.exe are registered as auto‑start Windows services running under System privileges, ensuring execution on every boot.
Both Uphero.exe and hero.exe are registered as auto‑start Windows services running under System privileges, ensuring execution on every boot.
“Traffic analysis shows a lightweight XOR‑encoded protocol (key 0x70) used to obscure control messages.”
The operators behind 7zip[.]com distributed a trojanized installer via a lookalike domain, delivering a functional copy of 7‑Zip File Manager alongside a concealed malware payload.
The malware incorporates multiple layers of sandbox and analysis evasion: Virtual machine detection targeting VMware, VirtualBox, QEMU, and Parallels
The malware incorporates multiple layers of sandbox and analysis evasion: Anti‑debugging checks and suspicious debugger DLL loading
“The installer is Authenticode‑signed using a now‑revoked certificate issued to Jozeal Network Technology Co., Limited, lending it superficial legitimacy.”
The malware invokes netsh to remove existing rules and create new inbound and outbound allow rules for its binaries.
The malware incorporates multiple layers of sandbox and analysis evasion: Process enumeration, registry probing, and environment inspection
“enumerates… network configuration… communicates with iplogger[.]org via a dedicated reporting endpoint”
The malware incorporates multiple layers of sandbox and analysis evasion: Process enumeration, registry probing, and environment inspection
Using WMI and native Windows APIs, the malware enumerates system characteristics including hardware identifiers, memory size, CPU count, disk attributes, and network configuration.
The malware incorporates multiple layers of sandbox and analysis evasion: Virtual machine detection targeting VMware, VirtualBox, QEMU, and Parallels
The malware incorporates multiple layers of sandbox and analysis evasion: Anti‑debugging checks and suspicious debugger DLL loading
Traffic analysis shows a lightweight XOR-encoded protocol (key 0x70) used to obscure control messages.
The hero.exe component retrieves configuration data from rotating “smshero”-themed command-and-control domains, then establishes outbound proxy connections on non-standard ports such as 1000 and 1002.
“traffic routed through Cloudflare infrastructure with TLS‑encrypted HTTPS sessions.”
The malware also uses DNS-over-HTTPS via Google’s resolver, reducing visibility for traditional DNS monitoring and complicating network-based detection.
“The infected host is enrolled as a residential proxy node, allowing third parties to route traffic through the victim’s IP address.”
In their Reddit post, the user described installing the file first on a laptop and later transferring it via USB to a newly built desktop.
Memory analysis uncovered a large pool of hardcoded command-and-control domains using hero and smshero naming conventions.
Active resolution during sandbox execution showed traffic routed through Cloudflare infrastructure with TLS‑encrypted HTTPS sessions.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.