Uphero

Uphero is a Windows malware component delivered via trojanized software installers, notably a fake 7-Zip installer distributed from the lookalike domain 7zip[.]com. The installer preserves legitimate 7-Zip functionality while covertly dropping three malicious components—Uphero.exe, hero.exe, and hero.dll—into C:\Windows\SysWOW64\hero. Uphero.exe acts as a service manager and update loader, while hero.exe is the main proxy payload and hero.dll is a supporting library. The malware establishes persistence by registering Uphero.exe and hero.exe as auto-start Windows services running with SYSTEM privileges and modifies Windows firewall rules via netsh to permit its traffic.

Its primary purpose is to enroll infected systems into a residential proxy network rather than function as a traditional backdoor. The malware profiles the host using WMI and Windows APIs, collecting hardware, memory, CPU, disk, and network information, and sends host data to iplogger[.]org. The proxy component retrieves configuration from rotating "smshero"/"hero"-themed command-and-control infrastructure, including observed domains such as soc.hero-sms[.]co, neo.herosms[.]co, flux.smshero[.]co, and nova.smshero[.]ai. Communications are carried over HTTPS through Cloudflare-fronted infrastructure, use DNS-over-HTTPS via Google’s resolver, and obfuscate control messages with XOR (reported key 0x70). The malware opens outbound proxy connections on non-standard ports including 1000 and 1002, allowing third parties to route traffic through the victim’s IP address.

The campaign also reportedly used trojanized installers for other popular software including HolaVPN, TikTok, WhatsApp, and Wire VPN. The malicious installer was signed with a certificate issued to Jozeal Network Technology Co., Limited that was later revoked. Anti-analysis behavior includes checks for virtualization platforms such as VMware, VirtualBox, QEMU, and Parallels, as well as debugger detection. High-confidence indicators and artifacts mentioned in the reporting include the dropped filenames Uphero.exe, hero.exe, and hero.dll; installation path C:\Windows\SysWOW64\hero; the fake distribution domain 7zip[.]com; exfiltration to iplogger[.]org; and the observed C2 domains soc.hero-sms[.]co, neo.herosms[.]co, flux.smshero[.]co, and nova.smshero[.]ai.