hero

“A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer… operators behind 7zip[.]com distributed a trojanized installer via a lookalike domain”

“Following a YouTube tutorial for a new build, they were instructed to download 7‑Zip from 7zip[.]com, unaware that the legitimate project is hosted exclusively at 7-zip.org.”

The malware incorporates multiple layers of sandbox and analysis evasion: Runtime API resolution and PEB inspection

A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer that silently converts victims’ machines into residential proxy nodes.

Both Uphero.exe and hero.exe are registered as auto‑start Windows services running under System privileges, ensuring execution on every boot.

Both Uphero.exe and hero.exe are registered as auto‑start Windows services running under System privileges, ensuring execution on every boot.

“Traffic analysis shows a lightweight XOR‑encoded protocol (key 0x70) used to obscure control messages.”

The operators behind 7zip[.]com distributed a trojanized installer via a lookalike domain, delivering a functional copy of 7‑Zip File Manager alongside a concealed malware payload.

The malware incorporates multiple layers of sandbox and analysis evasion: Virtual machine detection targeting VMware, VirtualBox, QEMU, and Parallels

The malware incorporates multiple layers of sandbox and analysis evasion: Anti‑debugging checks and suspicious debugger DLL loading

“The installer is Authenticode‑signed using a now‑revoked certificate issued to Jozeal Network Technology Co., Limited, lending it superficial legitimacy.”

The malware incorporates multiple layers of sandbox and analysis evasion: Process enumeration, registry probing, and environment inspection

“enumerates… network configuration… communicates with iplogger[.]org via a dedicated reporting endpoint”

The malware incorporates multiple layers of sandbox and analysis evasion: Process enumeration, registry probing, and environment inspection

Using WMI and native Windows APIs, the malware enumerates system characteristics including hardware identifiers, memory size, CPU count, disk attributes, and network configuration.

The malware incorporates multiple layers of sandbox and analysis evasion: Virtual machine detection targeting VMware, VirtualBox, QEMU, and Parallels

The malware incorporates multiple layers of sandbox and analysis evasion: Anti‑debugging checks and suspicious debugger DLL loading

Traffic analysis shows a lightweight XOR-encoded protocol (key 0x70) used to obscure control messages.

The hero.exe component retrieves configuration data from rotating “smshero”-themed command-and-control domains, then establishes outbound proxy connections on non-standard ports such as 1000 and 1002.

“traffic routed through Cloudflare infrastructure with TLS‑encrypted HTTPS sessions.”

The malware also uses DNS-over-HTTPS via Google’s resolver, reducing visibility for traditional DNS monitoring and complicating network-based detection.

“The infected host is enrolled as a residential proxy node, allowing third parties to route traffic through the victim’s IP address.”

In their Reddit post, the user described installing the file first on a laptop and later transferring it via USB to a newly built desktop.

Memory analysis uncovered a large pool of hardcoded command-and-control domains using hero and smshero naming conventions.

Active resolution during sandbox execution showed traffic routed through Cloudflare infrastructure with TLS‑encrypted HTTPS sessions.

The malware invokes netsh to remove existing rules and create new inbound and outbound allow rules for its binaries.