Hostspatcher

Overview

Riskware:Win32/Hostspatcher (or Trojan:Win32/Hostspatcher) is a specific classification for malware or Potentially Unwanted Applications (PUAs) whose primary function is to maliciously modify the Windows **HOSTS file** (`%SystemRoot%\System32\drivers\etc\hosts`). The HOSTS file is a local text file used by the operating system to map hostnames to IP addresses, overriding DNS. By altering this file, attackers can silently redirect a user's web traffic without touching the browser's settings.

Understanding the Hostspatcher Threat
To an end-user, the effects of a Hostspatcher are often baffling; they type `google.com` but end up on a search engine filled with ads, or they try to visit their bank but land on a perfect phishing replica. For a security analyst, unauthorized modification of the HOSTS file is a critical indicator of compromise, used for both aggressive adware injection and severe defense evasion.

Execution and Redirection Mechanics
Hostspatcher is usually dropped by secondary malware or deceptive software bundles (`T1189`). Upon execution with administrative privileges, the malware opens the local `hosts` file (`T1562.001`). It appends new routing rules. For example, to inject ads, it might map `www.yahoo.com` to the IP address of an attacker-controlled adware server (`T1112`). Crucially, to evade detection, Hostspatcher malware almost always adds entries mapping the update domains of major Antivirus vendors (e.g., `update.symantec.com`, `liveupdate.mcafee.com`) to `127.0.0.1` (localhost) or `0.0.0.0`. This effectively blinds the local AV, preventing it from downloading the new signatures needed to detect the malware.

Indicators of Compromise & Impact
The primary impact is the silent interception of web traffic and the crippling of local security defenses. Host-based IoCs include EDR alerts for any process (other than `notepad.exe` run by an admin) attempting to write to the `\drivers\etc\hosts` file. A manual review of the HOSTS file will reveal dozens or hundreds of unauthorized entries. Users may report 'Certificate Errors' when browsing, as the hijacked IP addresses will not have valid SSL certificates for the requested domain.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_HOSTSPATCHER {
    meta:
        description = "Detects Hostspatcher (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "hostspatcher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Hostspatcher Activity
id: dec56b097b4c270b4e4adbaf7d4470b6
status: experimental
description: Detects generic indicators of the hostspatcher malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*hostspatcher*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Open Notepad as an Administrator, navigate to `%SystemRoot%\System32\drivers\etc\`, open the `hosts` file, and delete all unauthorized entries.
2. Alternatively, use the Microsoft 'Fix It' tool or a command script to reset the HOSTS file to its Windows default state.
3. Investigate how the malware gained administrative privileges to modify the file; look for concurrent exploitation or unauthorized privilege escalation.
4. Run a full system scan with an updated enterprise AV, as Hostspatcher is rarely the only malware on the system; it is usually a precursor to prevent detection of a larger threat.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the network DNS servers are compromised if a user reports misdirection; always check the local HOSTS file first.
2. Avoid giving standard users local administrator privileges, as modifying the HOSTS file requires elevated rights.

References & External Analysis

• Search "hostspatcher" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Exxroute
• Sz4Aaw
• Equationdrug
• Deceptpcclean
• Simbot

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/hostspatcher.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.