{
  "family": "qhosts",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Qhosts is a classic, highly specific trojan whose primary malicious activity is modifying the Windows `hosts` file (`%SystemRoot%\\System32\\drivers\\etc\\hosts`). By altering this file, the attacker can silently hijack DNS resolution at the local level (`T1562.002`), redirecting the victim from legitimate websites (like banks, webmail, or antivirus vendors) to malicious phishing clones or sinkholes controlled by the attacker.<br><br><b>Understanding Qhosts (DNS/Hosts Hijacking)</b><br>To an end-user, the attack is invisible. They type `www.chase.com` into their browser, the browser shows `www.chase.com` in the address bar, but they are actually interacting with an attacker's server. For security analysts, Qhosts represents a fundamental attack on the integrity of the operating system's networking stack. It bypasses corporate DNS filtering entirely because the OS checks the local `hosts` file before querying an external DNS server.<br><br><b>Execution and Hijacking Mechanics</b><br>Qhosts is typically delivered as a small executable via spearphishing or dropped by a primary downloader. Upon execution, it requires administrative privileges. It opens the `hosts` file, removes any existing Read-Only attributes, and appends new entries. These entries map legitimate domain names (e.g., `bankofamerica.com`, `microsoft.com`) to the IP addresses of attacker-controlled servers. It frequently redirects domains associated with antivirus updates (e.g., `liveupdate.symantec.com`) to `127.0.0.1` (localhost), effectively preventing the security software from updating (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from credential theft via highly convincing phishing pages to the disabling of endpoint security tools. Host-based IoCs are straightforward: unauthorized modifications to the `%SystemRoot%\\System32\\drivers\\etc\\hosts` file, specifically the presence of mappings for banking, security, or major webmail providers. EDR alerts triggering on unexpected processes modifying this specific file path are critical indicators.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1556",
    "T1562.002",
    "T1012"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.002",
      "name": "Impair Defenses: Disable Windows Event Logging (Modifying the hosts file to block AV updates)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1556",
      "name": "Modify Authentication Process (Redirecting logins to phishing pages via DNS spoofing)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1012",
      "name": "Query Registry (Checking for installed security software before modifying the hosts file)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Immediately restore the `hosts` file to its default state (usually just containing `127.0.0.1 localhost`).",
    "Flush the local DNS cache (`ipconfig /flushdns`) to ensure the browser clears any cached malicious IP mappings.",
    "Run a full anti-malware scan to identify and remove the Qhosts executable that performed the modification.",
    "If the hosts file redirected to banking sites, immediately mandate password resets for any users who may have attempted to log in."
  ],
  "what_to_avoid": [
    "Do not trust the URL displayed in the browser's address bar if the `hosts` file has been compromised; the browser will display the legitimate domain name.",
    "Avoid leaving the `hosts` file writable by standard users; ensure strict file permissions are enforced via Group Policy."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}