Trojanized 7-Zip Installers from 7zip[.]com Used to Deploy Proxyware on Home PCs

Malwarebytes reported a malware distribution campaign in which attackers use a lookalike domain, 7zip[.]com, to impersonate the legitimate 7-Zip download site (7-zip.org) and deliver a trojanized installer that still appears to function as expected. The activity surfaced after a Reddit user described being directed to the fake site via a YouTube tutorial/comment, installing the software on multiple systems, and later receiving a generic Microsoft Defender trojan alert; Malwarebytes’ follow-on analysis concluded that systems running installers from 7zip[.]com should be treated as compromised.

Analysis of the counterfeit installer found it drops additional hidden components (including Uphero.exe, hero.exe, and hero.dll) into C:\Windows\SysWOW64\hero\ and establishes persistence by registering executables as Windows services that start with SYSTEM privileges. The primary payload was assessed as proxyware, turning infected home computers into residential proxy nodes that allow third parties to route traffic through victims’ IP addresses; the malware also includes anti-analysis checks to reduce detection. The installer was observed carrying an Authenticode signature issued to Jozeal Network Technology Co., Limited (reported as revoked), and defenders were advised to watch for unauthorized services and related network activity, and to block known C2/proxy infrastructure where possible.