Hostspatcher

Overview

Riskware:Win32/Hostspatcher (or Trojan:Win32/Hostspatcher) is a specific classification for malware or Potentially Unwanted Applications (PUAs) whose primary function is to maliciously modify the Windows **HOSTS file** (`%SystemRoot%\System32\drivers\etc\hosts`). The HOSTS file is a local text file used by the operating system to map hostnames to IP addresses, overriding DNS. By altering this file, attackers can silently redirect a user's web traffic without touching the browser's settings.

Understanding the Hostspatcher Threat
To an end-user, the effects of a Hostspatcher are often baffling; they type `google.com` but end up on a search engine filled with ads, or they try to visit their bank but land on a perfect phishing replica. For a security analyst, unauthorized modification of the HOSTS file is a critical indicator of compromise, used for both aggressive adware injection and severe defense evasion.

Execution and Redirection Mechanics
Hostspatcher is usually dropped by secondary malware or deceptive software bundles (`T1189`). Upon execution with administrative privileges, the malware opens the local `hosts` file (`T1562.001`). It appends new routing rules. For example, to inject ads, it might map `www.yahoo.com` to the IP address of an attacker-controlled adware server (`T1112`). Crucially, to evade detection, Hostspatcher malware almost always adds entries mapping the update domains of major Antivirus vendors (e.g., `update.symantec.com`, `liveupdate.mcafee.com`) to `127.0.0.1` (localhost) or `0.0.0.0`. This effectively blinds the local AV, preventing it from downloading the new signatures needed to detect the malware.

Indicators of Compromise & Impact
The primary impact is the silent interception of web traffic and the crippling of local security defenses. Host-based IoCs include EDR alerts for any process (other than `notepad.exe` run by an admin) attempting to write to the `\drivers\etc\hosts` file. A manual review of the HOSTS file will reveal dozens or hundreds of unauthorized entries. Users may report 'Certificate Errors' when browsing, as the hijacked IP addresses will not have valid SSL certificates for the requested domain.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_HOSTSPATCHER_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hostspatcher"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "hostspatcher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Hostspatcher (Trojan) Execution & Triage
id: c46848e7-c0fc-5c67-b26a-286fb229dc33
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Hostspatcher malware family. Detects suspicious execution from temporary
  user directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/hostspatcher
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1112
- attack.t1562_001
- attack.t1498
- attack.t1556
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_HOSTSPATCHER_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hostspatcher tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "hostspatcher" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Open Notepad as an Administrator, navigate to `%SystemRoot%\System32\drivers\etc\`, open the `hosts` file, and delete all unauthorized entries.
2. Alternatively, use the Microsoft 'Fix It' tool or a command script to reset the HOSTS file to its Windows default state.
3. Investigate how the malware gained administrative privileges to modify the file; look for concurrent exploitation or unauthorized privilege escalation.
4. Run a full system scan with an updated enterprise AV, as Hostspatcher is rarely the only malware on the system; it is usually a precursor to prevent detection of a larger threat.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the network DNS servers are compromised if a user reports misdirection; always check the local HOSTS file first.
2. Avoid giving standard users local administrator privileges, as modifying the HOSTS file requires elevated rights.

References & External Analysis

• Search "hostspatcher" on VirusTotal (External Analysis)
• Search "hostspatcher" on Any.Run (Sandbox Sandbox)
• Search "hostspatcher" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Goldun
• Hpcubestlr
• Activitymonitor
• Pcreviver
• Aauto
• Optix
• Diztakun
• Bisonal

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/hostspatcher.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.