Malware

hero.exe

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.001DomainsEvidence1

Utilisation de la technique drop-catching : acquisition de domaines expirés ayant hérité d’une réputation SEO accidentelle (ex. 7zip[.]com , référencé par erreur dans des forums pendant des années)

T1608.001Upload MalwareEvidence1

Distribution de faux installeurs se substituant à des logiciels légitimes (7-Zip, outils de téléchargement TikTok/YouTube)

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

Victims searching for the free archiving software were instead led to a lookalike site that installed hidden proxy software instead of the real program.

T1195.002Compromise Software Supply ChainEvidence1

Deep dive into the UpStage Proxy malware campaign abusing a fake 7-Zip installer to deploy a GO-based residential proxy backdoor on Windows systems.

Execution

2 techniques

T1204.002Malicious FileEvidence2

Les victimes installent un logiciel proxy caché qui loue leur connexion internet à des clients payants sans leur consentement

T1569.002Service ExecutionEvidence1

hero.exe is run and installed as a service on the machine

Persistence

2 techniques

T1112Modify RegistryEvidence1

レジストリ操作から、少なくとも2つのサービスが作成され、自動起動(Start=2)であることが確認できました。

T1543.003Windows ServiceEvidence2

実行すると C:\Windows\SysWOW64\hero 配下に不審なファイル(例: hero.exe )が配置され、サービス登録されて SYSTEM 権限で自動実行される事例が報告されています。

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence2

Stealth

3 techniques

T1036MasqueradingEvidence2

今年に入って、7-Zip を装った非公式Webサイト経由で不審なインストーラが配布されていることが確認されています。

T1036.005Match Legitimate Resource Name or LocationEvidence1

Distribution de faux installeurs se substituant à des logiciels légitimes (7-Zip, outils de téléchargement TikTok/YouTube)

T1497Virtualization/Sandbox EvasionEvidence1

certain strings within the binary suggest it looks to see if its running on a VM.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

レジストリ操作から、少なくとも2つのサービスが作成され、自動起動(Start=2)であることが確認できました。

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

The use of ip lookup appears to occur (geolocation?), and some basic system fingerprinting.

T1497Virtualization/Sandbox EvasionEvidence1

certain strings within the binary suggest it looks to see if its running on a VM.

Command and Control

7 techniques

T1001Data ObfuscationEvidence1

I quickly recognized what looks like XOR encoding in some of the payload and was reward with uncovering multiple domains when applying XOR key 70.

T1071Application Layer ProtocolEvidence3

複数の外部ドメインへ通信(DNS・TLS/HTTPS・一部HTTP)している痕跡が確認できました。

T1090ProxyEvidence2

Once running, the malware quietly rented out the victim’s internet connection to paying customers without their knowledge or consent.

T1090.002External ProxyEvidence1

Les victimes installent un logiciel proxy caché qui loue leur connexion internet à des clients payants sans leur consentement

T1095Non-Application Layer ProtocolEvidence1

また、別の外部IP(例: 84.17.37.xxx )に対して 1002/TCP への接続も観測され、一般的なWeb通信(80/443)以外のポートへのアウトバウンドが発生している点は注視ポイントです

T1102Web ServiceEvidence1

Un lien IPLogger hardcodé dans les samples de malware a permis de relier l’ensemble des campagnes entre elles

T1105Ingress Tool TransferEvidence1

The installer drops a version of 7zfm.exe ... it has embedded within it 3 files (upHreo.exe, hero.exe, and hero.dll).

Other

1 technique

T1562.004Disable or Modify System FirewallEvidence2

Uphero.exe から cmd.exe → netsh.exe が起動され、Windows ファイアウォールに対して規則の削除・追加が実行されていました。

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

10 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

raichulab qiitaNews

Jan 24, 2026

7-Zip 偽サイト由来と思われる "hero.exe" を動的解析してみた(Windows 11 / CSVログベース) #Security - Qiita

7-Zipを装った偽サイト経由で配布された不審なマルウェア。C:\Windows\SysWOW64\hero\ に hero.exe、Uphero.exe、hero.dll を配置し、hero および Uphero の2つのWindowsサービスとして LocalSystem 権限・自動起動で永続化する。自身の通信を許可するWindowsファイアウォール規則を追加し、WMIでBIOS、CPU、ディスク、MACアドレスなどの端末情報を収集するほか、hero-sms / smshero 系ドメインや外部IPの80/TCP、1002/TCPへ通信する挙動が観測されている。

security magic blogNews

Jan 1, 2026

Beware of Fake 7zip Installer: upStage Proxy

Primary payload component of the UpStage Proxy infection chain. It is installed as a Windows service, communicates with config/control domains, and establishes direct connections to tunnel/proxy endpoints as part of the residential proxy backdoor behavior.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

hero.exe

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.001DomainsEvidence1

T1608.001Upload MalwareEvidence1

Distribution de faux installeurs se substituant à des logiciels légitimes (7-Zip, outils de téléchargement TikTok/YouTube)

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

Victims searching for the free archiving software were instead led to a lookalike site that installed hidden proxy software instead of the real program.

T1195.002Compromise Software Supply ChainEvidence1

Deep dive into the UpStage Proxy malware campaign abusing a fake 7-Zip installer to deploy a GO-based residential proxy backdoor on Windows systems.

Execution

2 techniques

T1204.002Malicious FileEvidence2

Les victimes installent un logiciel proxy caché qui loue leur connexion internet à des clients payants sans leur consentement

T1569.002Service ExecutionEvidence1

hero.exe is run and installed as a service on the machine

Persistence

2 techniques

T1112Modify RegistryEvidence1

レジストリ操作から、少なくとも2つのサービスが作成され、自動起動(Start=2)であることが確認できました。

T1543.003Windows ServiceEvidence2

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence2

Stealth

3 techniques

T1036MasqueradingEvidence2

今年に入って、7-Zip を装った非公式Webサイト経由で不審なインストーラが配布されていることが確認されています。

T1036.005Match Legitimate Resource Name or LocationEvidence1

Distribution de faux installeurs se substituant à des logiciels légitimes (7-Zip, outils de téléchargement TikTok/YouTube)

T1497Virtualization/Sandbox EvasionEvidence1

certain strings within the binary suggest it looks to see if its running on a VM.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

レジストリ操作から、少なくとも2つのサービスが作成され、自動起動(Start=2)であることが確認できました。

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

The use of ip lookup appears to occur (geolocation?), and some basic system fingerprinting.

T1497Virtualization/Sandbox EvasionEvidence1

certain strings within the binary suggest it looks to see if its running on a VM.

Command and Control

7 techniques

T1001Data ObfuscationEvidence1

I quickly recognized what looks like XOR encoding in some of the payload and was reward with uncovering multiple domains when applying XOR key 70.

T1071Application Layer ProtocolEvidence3

複数の外部ドメインへ通信(DNS・TLS/HTTPS・一部HTTP)している痕跡が確認できました。

T1090ProxyEvidence2

Once running, the malware quietly rented out the victim’s internet connection to paying customers without their knowledge or consent.

T1090.002External ProxyEvidence1

Les victimes installent un logiciel proxy caché qui loue leur connexion internet à des clients payants sans leur consentement

T1095Non-Application Layer ProtocolEvidence1

T1102Web ServiceEvidence1

Un lien IPLogger hardcodé dans les samples de malware a permis de relier l’ensemble des campagnes entre elles

T1105Ingress Tool TransferEvidence1

The installer drops a version of 7zfm.exe ... it has embedded within it 3 files (upHreo.exe, hero.exe, and hero.dll).

Other

1 technique

T1562.004Disable or Modify System FirewallEvidence2

Uphero.exe から cmd.exe → netsh.exe が起動され、Windows ファイアウォールに対して規則の削除・追加が実行されていました。

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

10 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

raichulab qiitaNews

Jan 24, 2026

7-Zip 偽サイト由来と思われる "hero.exe" を動的解析してみた(Windows 11 / CSVログベース) #Security - Qiita

security magic blogNews

Jan 1, 2026

Beware of Fake 7zip Installer: upStage Proxy

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.