Fake 7zip Installer Targets Users with UpStage Proxy Malware

UpStage Proxy, a sophisticated malware strain, is being distributed through a fake 7zip installer. This fake installer, which mimics the legitimate 7zip software, exploits unsuspecting users by using a misleading certificate to appear trustworthy.

Upon installation, the malware opens a backdoor, granting remote attackers full control over the infected system, turning it into a residential proxy that can be used for malicious purposes. The incident represents a growing trend of exploiting software download platforms to distribute malware.

How the Fake 7zip Installer Works

The attack begins when a user downloads the installer from a fake 7zip website, 7zip[.]com, which appears legitimate but is actually controlled by cybercriminals. The fake installer is signed with a revoked certificate issued to “JOZEAL NETWORK TECHNOLOGY CO., LIMITED”, which has since been flagged as suspicious. Despite the certificate’s credibility, it does not protect the user from the malware’s payload.

Once executed, the installer drops several malicious files on the system:

• 7zfm.exe: A disguised executable that masquerades as the legitimate 7zip installer.
• upHreo.exe, hero.exe, hero.dll: Payload components that activate the malware and establish persistent access on the infected machine.

These components work together to exploit system privileges and establish remote access for the attacker. The upHreo.exe file opens a port using netsh (a Windows command-line utility), disabling the firewall, and ensuring that the malware can connect to external Command-and-Control (C2) servers without interference.

The Proxy Mechanism and Command-and-Control Communication

The malicious files also enable the malware to turn the infected system into a residential proxy. By hijacking system resources and routing network traffic through the infected machine, the attacker can use the system to conduct malicious activities without raising suspicion.

This proxy functionality can be abused for various purposes, including anonymizing cyberattacks, data scraping, and malicious traffic routing.

In addition to the proxy capabilities, the malware uses XOR encryption to hide C2 communications. This helps prevent detection by security tools and makes it harder for defenders to identify malicious traffic patterns.

The malware connects to the C2 servers to receive commands, which include file exfiltration, data collection, and system manipulation.

The attackers also maintain control over the victim’s machine for extended periods, ensuring that the malware persists through reboots by installing it as a system service. It uses PowerShell scripts to maintain its foothold, creating multiple persistence mechanisms to avoid detection.

Indicators of Compromise (IoCs)

Below are the IoCs related to this attack, which can be used to track the malware’s presence on compromised systems:

Source: blog.lukeacha.com

Detection and Mitigation

Detection of this malware can be achieved by monitoring for unusual network traffic, particularly outbound traffic on port 8080 to suspicious IP addresses. Additionally, file integrity checks and hash matching against known malicious files such as 7zfm.exe can help identify infected machines.

Organizations should also ensure that users only download software from official sources. Implementing application whitelisting and using advanced endpoint protection solutions can prevent the installation of unauthorized applications. Furthermore, regular security patching and user awareness campaigns can help mitigate the risk of falling victim to similar attacks in the future.

Conclusion

The fake 7zip installer distributing UpStage Proxy represents a growing trend in the exploitation of trusted software platforms for cybercriminal purposes. By turning compromised systems into proxies and using encryption to hide C2 communications, the malware demonstrates the advanced capabilities of modern cyberattacks. Security professionals must be vigilant, regularly monitor network traffic, and employ robust security measures to protect against these types of attacks.

Read the detailed blog here.