{
  "family": "hostspatcher",
  "sample_count": 6,
  "category": "trojan",
  "description": "Riskware:Win32/Hostspatcher (or Trojan:Win32/Hostspatcher) is a specific classification for malware or Potentially Unwanted Applications (PUAs) whose primary function is to maliciously modify the Windows **HOSTS file** (`%SystemRoot%\\System32\\drivers\\etc\\hosts`). The HOSTS file is a local text file used by the operating system to map hostnames to IP addresses, overriding DNS. By altering this file, attackers can silently redirect a user's web traffic without touching the browser's settings.<br><br><b>Understanding the Hostspatcher Threat</b><br>To an end-user, the effects of a Hostspatcher are often baffling; they type `google.com` but end up on a search engine filled with ads, or they try to visit their bank but land on a perfect phishing replica. For a security analyst, unauthorized modification of the HOSTS file is a critical indicator of compromise, used for both aggressive adware injection and severe defense evasion.<br><br><b>Execution and Redirection Mechanics</b><br>Hostspatcher is usually dropped by secondary malware or deceptive software bundles (`T1189`). Upon execution with administrative privileges, the malware opens the local `hosts` file (`T1562.001`). It appends new routing rules. For example, to inject ads, it might map `www.yahoo.com` to the IP address of an attacker-controlled adware server (`T1112`). Crucially, to evade detection, Hostspatcher malware almost always adds entries mapping the update domains of major Antivirus vendors (e.g., `update.symantec.com`, `liveupdate.mcafee.com`) to `127.0.0.1` (localhost) or `0.0.0.0`. This effectively blinds the local AV, preventing it from downloading the new signatures needed to detect the malware.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the silent interception of web traffic and the crippling of local security defenses. Host-based IoCs include EDR alerts for any process (other than `notepad.exe` run by an admin) attempting to write to the `\\drivers\\etc\\hosts` file. A manual review of the HOSTS file will reveal dozens or hundreds of unauthorized entries. Users may report 'Certificate Errors' when browsing, as the hijacked IP addresses will not have valid SSL certificates for the requested domain.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1562.001",
    "T1498",
    "T1556"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Blocking AV updates via HOSTS)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry / Local Files (Writing to the HOSTS file)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1556",
      "name": "Modify Authentication Process (Redirecting to phishing sites)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Routing traffic to localhost)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Open Notepad as an Administrator, navigate to `%SystemRoot%\\System32\\drivers\\etc\\`, open the `hosts` file, and delete all unauthorized entries.",
    "Alternatively, use the Microsoft 'Fix It' tool or a command script to reset the HOSTS file to its Windows default state.",
    "Investigate how the malware gained administrative privileges to modify the file; look for concurrent exploitation or unauthorized privilege escalation.",
    "Run a full system scan with an updated enterprise AV, as Hostspatcher is rarely the only malware on the system; it is usually a precursor to prevent detection of a larger threat."
  ],
  "what_to_avoid": [
    "Do not assume the network DNS servers are compromised if a user reports misdirection; always check the local HOSTS file first.",
    "Avoid giving standard users local administrator privileges, as modifying the HOSTS file requires elevated rights."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}