Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Домен 7zip[.]com имитирует 7-zip[.]org; рабочий 7-Zip включён в состав установщика.
Протокол использует XOR-кодирование с ключом 0x70 для обфускации управляющих сообщений.
certain strings within the binary suggest it looks to see if its running on a VM.
Через WMI и нативные Windows API собираются hardware ID, RAM, число ядер CPU, параметры дисков и сетевая конфигурация.
certain strings within the binary suggest it looks to see if its running on a VM.
I quickly recognized what looks like XOR encoding in some of the payload and was reward with uncovering multiple domains when applying XOR key 70.
DNS-резолвинг идёт через DNS-over-HTTPS (Google resolver), поэтому стандартный DNS-мониторинг запросы не увидит.
Once running, the malware quietly rented out the victim’s internet connection to paying customers without their knowledge or consent.
Les victimes installent un logiciel proxy caché qui loue leur connexion internet à des clients payants sans leur consentement
Заражённый хост устанавливает исходящие прокси-соединения к 79.127.221[.]47 на нестандартных портах 1000 и 1002.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
7-Zipを装った偽サイト経由で配布された不審なマルウェア。C:\Windows\SysWOW64\hero\ に hero.exe、Uphero.exe、hero.dll を配置し、hero および Uphero の2つのWindowsサービスとして LocalSystem 権限・自動起動で永続化する。自身の通信を許可するWindowsファイアウォール規則を追加し、WMIでBIOS、CPU、ディスク、MACアドレスなどの端末情報を収集するほか、hero-sms / smshero 系ドメインや外部IPの80/TCP、1002/TCPへ通信する挙動が観測されている。
Primary payload component of the UpStage Proxy infection chain. It is installed as a Windows service, communicates with config/control domains, and establishes direct connections to tunnel/proxy endpoints as part of the residential proxy backdoor behavior.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.