{
  "family": "hostspatcher",
  "sample_count": 6,
  "category": "trojan",
  "description": "Riskware:Win32/Hostspatcher (or Trojan:Win32/Hostspatcher) is a specific classification for malware or Potentially Unwanted Applications (PUAs) whose primary function is to maliciously modify the Windows **HOSTS file** (`%SystemRoot%\\System32\\drivers\\etc\\hosts`). The HOSTS file is a local text file used by the operating system to map hostnames to IP addresses, overriding DNS. By altering this file, attackers can silently redirect a user's web traffic without touching the browser's settings.<br><br><b>Understanding the Hostspatcher Threat</b><br>To an end-user, the effects of a Hostspatcher are often baffling; they type `google.com` but end up on a search engine filled with ads, or they try to visit their bank but land on a perfect phishing replica. For a security analyst, unauthorized modification of the HOSTS file is a critical indicator of compromise, used for both aggressive adware injection and severe defense evasion.<br><br><b>Execution and Redirection Mechanics</b><br>Hostspatcher is usually dropped by secondary malware or deceptive software bundles (`T1189`). Upon execution with administrative privileges, the malware opens the local `hosts` file (`T1562.001`). It appends new routing rules. For example, to inject ads, it might map `www.yahoo.com` to the IP address of an attacker-controlled adware server (`T1112`). Crucially, to evade detection, Hostspatcher malware almost always adds entries mapping the update domains of major Antivirus vendors (e.g., `update.symantec.com`, `liveupdate.mcafee.com`) to `127.0.0.1` (localhost) or `0.0.0.0`. This effectively blinds the local AV, preventing it from downloading the new signatures needed to detect the malware.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the silent interception of web traffic and the crippling of local security defenses. Host-based IoCs include EDR alerts for any process (other than `notepad.exe` run by an admin) attempting to write to the `\\drivers\\etc\\hosts` file. A manual review of the HOSTS file will reveal dozens or hundreds of unauthorized entries. Users may report 'Certificate Errors' when browsing, as the hijacked IP addresses will not have valid SSL certificates for the requested domain.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Hostspatcher and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hostspatcher is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hostspatcher establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hostspatcher typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Hostspatcher compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Hostspatcher should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Hostspatcher?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hostspatcher frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Hostspatcher across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Hostspatcher by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1112",
    "T1562.001",
    "T1498",
    "T1556"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Blocking AV updates via HOSTS)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry / Local Files (Writing to the HOSTS file)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1556",
      "name": "Modify Authentication Process (Redirecting to phishing sites)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Routing traffic to localhost)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Open Notepad as an Administrator, navigate to `%SystemRoot%\\System32\\drivers\\etc\\`, open the `hosts` file, and delete all unauthorized entries.",
    "Alternatively, use the Microsoft 'Fix It' tool or a command script to reset the HOSTS file to its Windows default state.",
    "Investigate how the malware gained administrative privileges to modify the file; look for concurrent exploitation or unauthorized privilege escalation.",
    "Run a full system scan with an updated enterprise AV, as Hostspatcher is rarely the only malware on the system; it is usually a precursor to prevent detection of a larger threat."
  ],
  "what_to_avoid": [
    "Do not assume the network DNS servers are compromised if a user reports misdirection; always check the local HOSTS file first.",
    "Avoid giving standard users local administrator privileges, as modifying the HOSTS file requires elevated rights."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}