{
  "family": "qhosts",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Qhosts is a classic, highly specific trojan whose primary malicious activity is modifying the Windows `hosts` file (`%SystemRoot%\\System32\\drivers\\etc\\hosts`). By altering this file, the attacker can silently hijack DNS resolution at the local level (`T1562.002`), redirecting the victim from legitimate websites (like banks, webmail, or antivirus vendors) to malicious phishing clones or sinkholes controlled by the attacker.<br><br><b>Understanding Qhosts (DNS/Hosts Hijacking)</b><br>To an end-user, the attack is invisible. They type `www.chase.com` into their browser, the browser shows `www.chase.com` in the address bar, but they are actually interacting with an attacker's server. For security analysts, Qhosts represents a fundamental attack on the integrity of the operating system's networking stack. It bypasses corporate DNS filtering entirely because the OS checks the local `hosts` file before querying an external DNS server.<br><br><b>Execution and Hijacking Mechanics</b><br>Qhosts is typically delivered as a small executable via spearphishing or dropped by a primary downloader. Upon execution, it requires administrative privileges. It opens the `hosts` file, removes any existing Read-Only attributes, and appends new entries. These entries map legitimate domain names (e.g., `bankofamerica.com`, `microsoft.com`) to the IP addresses of attacker-controlled servers. It frequently redirects domains associated with antivirus updates (e.g., `liveupdate.symantec.com`) to `127.0.0.1` (localhost), effectively preventing the security software from updating (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from credential theft via highly convincing phishing pages to the disabling of endpoint security tools. Host-based IoCs are straightforward: unauthorized modifications to the `%SystemRoot%\\System32\\drivers\\etc\\hosts` file, specifically the presence of mappings for banking, security, or major webmail providers. EDR alerts triggering on unexpected processes modifying this specific file path are critical indicators.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Qhosts and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Qhosts is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Qhosts establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Qhosts typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Qhosts compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Qhosts should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Qhosts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Qhosts frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Qhosts across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Qhosts by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1556",
    "T1562.002",
    "T1012"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.002",
      "name": "Impair Defenses: Disable Windows Event Logging (Modifying the hosts file to block AV updates)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1556",
      "name": "Modify Authentication Process (Redirecting logins to phishing pages via DNS spoofing)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1012",
      "name": "Query Registry (Checking for installed security software before modifying the hosts file)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Immediately restore the `hosts` file to its default state (usually just containing `127.0.0.1 localhost`).",
    "Flush the local DNS cache (`ipconfig /flushdns`) to ensure the browser clears any cached malicious IP mappings.",
    "Run a full anti-malware scan to identify and remove the Qhosts executable that performed the modification.",
    "If the hosts file redirected to banking sites, immediately mandate password resets for any users who may have attempted to log in."
  ],
  "what_to_avoid": [
    "Do not trust the URL displayed in the browser's address bar if the `hosts` file has been compromised; the browser will display the legitimate domain name.",
    "Avoid leaving the `hosts` file writable by standard users; ensure strict file permissions are enforced via Group Policy."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}