Loading malware…
Hero is a Windows proxyware malware family delivered via trojanized software installers, notably a fake 7-Zip installer distributed from the lookalike domain 7zip[.]com. The installer preserves normal 7-Zip functionality while covertly dropping Uphero.exe, hero.exe, and hero.dll into C:\Windows\SysWOW64\hero. Uphero.exe acts as a service manager and update loader, hero.exe is the main proxy payload, and hero.dll is a supporting library. The malware establishes persistence by registering Windows services configured to start automatically with SYSTEM privileges and modifies Windows firewall rules via netsh to permit inbound and outbound connectivity for its binaries. Its primary purpose is to enroll infected machines into a residential proxy network, allowing third parties to route traffic through victim IP addresses. Hero profiles the host using WMI and Windows APIs, collecting hardware, memory, CPU, disk, and network information, and sends system data to iplogger[.]org. It retrieves configuration from rotating command-and-control infrastructure using hero/smshero-themed domains, including observed domains soc.hero-sms[.]co, neo.herosms[.]co, flux.smshero[.]co, and nova.smshero[.]ai. Communications are carried over TLS-encrypted HTTPS through Cloudflare-fronted infrastructure, with DNS-over-HTTPS via Google’s resolver, and control messages are obfuscated with XOR using key 0x70. Observed outbound proxy connections use non-standard ports including 1000 and 1002. The malware also includes anti-analysis checks for virtualization platforms such as VMware, VirtualBox, QEMU, and Parallels, as well as debugger detection. The broader campaign has also used trojanized installers for HolaVPN, TikTok, WhatsApp, and Wire VPN. The analyzed installer was digitally signed with a certificate issued to Jozeal Network Technology Co., Limited that was later revoked.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
“Traffic analysis shows a lightweight XOR‑encoded protocol (key 0x70) used to obscure control messages.”
“delivering a functional copy of… 7‑Zip File Manager alongside a concealed malware payload… a modified build of 7zfm.exe is deployed and functions as expected”
“enumerates… network configuration… communicates with iplogger[.]org via a dedicated reporting endpoint”
“the malware enumerates system characteristics including hardware identifiers, memory size, CPU count, disk attributes, and network configuration.”
“traffic routed through Cloudflare infrastructure with TLS‑encrypted HTTPS sessions.”
“The infected host is enrolled as a residential proxy node, allowing third parties to route traffic through the victim’s IP address.”
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Residential proxy malware delivered via a trojanized 7-Zip installer; persists via SYSTEM-level Windows services, modifies firewall rules via netsh, profiles the host, uses HTTPS C2 (often Cloudflare-fronted), XOR-obfuscates control messages (key 0x70), uses DNS-over-HTTPS, and opens outbound proxy connections on non-standard ports (e.g., 1000/1002) to relay third-party traffic through the victim IP.
Main proxy payload component used to turn infected hosts into residential proxy nodes. Retrieves configuration from rotating C2 domains, establishes proxy connections on non-standard ports (e.g., 1000/1002), and uses XOR-obfuscated control messaging; traffic is routed via Cloudflare and carried over TLS/HTTPS, with DNS-over-HTTPS to reduce defender visibility.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.