Qhosts

Overview

Trojan:Win32/Qhosts is a classic, highly specific trojan whose primary malicious activity is modifying the Windows `hosts` file (`%SystemRoot%\System32\drivers\etc\hosts`). By altering this file, the attacker can silently hijack DNS resolution at the local level (`T1562.002`), redirecting the victim from legitimate websites (like banks, webmail, or antivirus vendors) to malicious phishing clones or sinkholes controlled by the attacker.

Understanding Qhosts (DNS/Hosts Hijacking)
To an end-user, the attack is invisible. They type `www.chase.com` into their browser, the browser shows `www.chase.com` in the address bar, but they are actually interacting with an attacker's server. For security analysts, Qhosts represents a fundamental attack on the integrity of the operating system's networking stack. It bypasses corporate DNS filtering entirely because the OS checks the local `hosts` file before querying an external DNS server.

Execution and Hijacking Mechanics
Qhosts is typically delivered as a small executable via spearphishing or dropped by a primary downloader. Upon execution, it requires administrative privileges. It opens the `hosts` file, removes any existing Read-Only attributes, and appends new entries. These entries map legitimate domain names (e.g., `bankofamerica.com`, `microsoft.com`) to the IP addresses of attacker-controlled servers. It frequently redirects domains associated with antivirus updates (e.g., `liveupdate.symantec.com`) to `127.0.0.1` (localhost), effectively preventing the security software from updating (`T1562.001`).

Indicators of Compromise & Impact
The impact ranges from credential theft via highly convincing phishing pages to the disabling of endpoint security tools. Host-based IoCs are straightforward: unauthorized modifications to the `%SystemRoot%\System32\drivers\etc\hosts` file, specifically the presence of mappings for banking, security, or major webmail providers. EDR alerts triggering on unexpected processes modifying this specific file path are critical indicators.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_QHOSTS {
    meta:
        description = "Detects Qhosts (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "qhosts" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Qhosts Activity
id: a204227c44a47b059a7289c593578717
status: experimental
description: Detects generic indicators of the qhosts malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*qhosts*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately restore the `hosts` file to its default state (usually just containing `127.0.0.1 localhost`).
2. Flush the local DNS cache (`ipconfig /flushdns`) to ensure the browser clears any cached malicious IP mappings.
3. Run a full anti-malware scan to identify and remove the Qhosts executable that performed the modification.
4. If the hosts file redirected to banking sites, immediately mandate password resets for any users who may have attempted to log in.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust the URL displayed in the browser's address bar if the `hosts` file has been compromised; the browser will display the legitimate domain name.
2. Avoid leaving the `hosts` file writable by standard users; ensure strict file permissions are enforced via Group Policy.

References & External Analysis

• Search "qhosts" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Jacksbot
• Fujacks
• Winreg
• Look2Me
• Btcon

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/qhosts.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.