UnknownPublished 12 Feb 2026Updated 2 Mar 2026

type osint · Fake 7-Zip downloads are turning home PCs into proxy nodes

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Fake 7-Zip downloads are turning home PCs into proxy nodes

Impact

Infected home PCs are turned into proxy nodes, potentially allowing attackers to route malicious traffic through these compromised systems. This can lead to abuse of the victim's network resources and may facilitate further malicious activities such as anonymizing attacker traffic or launching additional attacks. The threat compromises system integrity and security by disabling or modifying firewalls and establishing persistence mechanisms. However, there is no evidence of widespread exploitation or direct data theft reported at this time.

Defensive guidance

Users should avoid downloading 7-Zip or similar software from untrusted or unofficial sources to prevent infection. Employing endpoint protection solutions that can detect masquerading, code signing anomalies, and firewall modifications may help mitigate risk. Since no vendor advisory or official remediation exists, monitoring for suspicious proxy activity and unauthorized changes to system firewall settings is recommended.

Indicators of compromise

Domains 17

zest.hero-sms.ai
soc.hero-sms.co
apex.herosms.ai
flux.smshero.co
neo.herosms.co
glide.smshero.cc
prime.herosms.vip
mint.smshero.com
spark.herosms.io
nova.smshero.ai

URLs 1

update.7zip.com/version/win-service/1.0.0.2/Uphero.exe.zip

IP addresses 4

172.67.160.241
104.21.57.71
162.159.36.2
8.8.8.8

Hashes 12

c4edf28177e72d1bfc482cf4d05a156b
aeda326c3653f17120bb0d75738c0bd82e7f7f31
e7291095de78484039fdc82106d191bf41b7469811c4e31b4228227911d25027
ddf75cc7e322d75de77b17c8ec887975
664e87fe1d01dfe6f03f6027c09fcfa117ffb27e
3544ffefb2a38bf4faf6181aa4374f4c186d3c2a7b9b059244b65dce8d5688d9
e2022cedcea9b5ea81764996732a9880
01ef636f9627a77ae11af9af88dd52106b163422
b7a7013b951c3cea178ece3363e3dd06626b9b98ee27ebfd7c161d0bbcfbd894
c4edf28177e72d1bfc482cf4d05a156b

Link 9

https://otx.alienvault.com/pulse/698d9d85f511c437a687cbad
https://www.malwarebytes.com/blog/threat-intel/2026/02/fake-7-zip-downloads-are-turning-home-pcs-into-proxy-nodes
https://www.virustotal.com/gui/file/e7291095de78484039fdc82106d191bf41b7469811c4e31b4228227911d25027
https://www.virustotal.com/gui/domain/soc.hero-sms.co
https://www.virustotal.com/gui/domain/svc.ha-teams.office.com
https://www.virustotal.com/gui/ip_address/104.21.57.71
https://www.virustotal.com/gui/ip_address/162.159.36.2
https://www.virustotal.com/gui/ip_address/172.67.160.241
https://www.virustotal.com/gui/ip_address/8.8.8.8

Text 14

A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer that silently converts victims' machines into residential proxy nodes. The fake site, 7zip[.]com, distributes a functional copy of 7-Zip alongside concealed malware. The malware deploys three components: Uphero.exe (service manager), hero.exe (proxy payload), and hero.dll (supporting library). It establishes persistence through Windows services, manipulates firewall rules, and profiles the host system. The primary function is to enroll infected hosts as residential proxy nodes, allowing third parties to route traffic through victims' IP addresses. This campaign appears to be part of a broader operation with similar tactics used for other fake installers. The malware incorporates multiple evasion techniques and uses encrypted communications.
Fake 7-Zip downloads are turning home PCs into proxy nodes
Blog
%WINDIR%\SysWOW64\hero\
%WINDIR%\SysWOW64\hero\
%WINDIR%\SysWOW64\hero\
Global\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7
43/72
20/93
0/93

Datetime 3

2026-01-01T10:22:12+00:00
2026-01-01T06:55:15+00:00
2026-01-01T07:04:25+00:00

Imphash 6

3c9f80f2e71286e71d7f91cdd26c6049
3c9f80f2e71286e71d7f91cdd26c6049
ef2950805cfd017c3b005284a639e584
ef2950805cfd017c3b005284a639e584
eb896ed888a5d9e17921ad8ac5f846bd
eb896ed888a5d9e17921ad8ac5f846bd

Size in bytes 3

2382808
5682336
350168

File 3

Uphero.exe
hero.dll
hero.exe

Pehash 3

8b4f571c395d8fd561ef9ef4647ad09842caa6fb
1d08a3b26f90e0624d5b07a15ae79c0c0d9775fe
723a905b947abc9781f36665287bd69cc606cde2

Tlsh 1

t1deb5be12bb42c172f592027452fa6b7f883e9934673485c397d01e7989312e36b3e79e

Vhash 1

026056655d551561e3z72z8f7z9055z2031z31z5001f4z16c

Ssdeep 1

49152:hCV3m+X04yQjatPNBlG1coHqi47Nr9TPcPQJ1ErF/Yys:y3m14yNtPNBlG1coHq77NrN13

Community reviews

Loading reviews…