⚠️ Overview

QHost is a DNS hijacking trojan first documented in 2015 by security researchers at Kaspersky Lab, primarily targeting Windows systems to redirect web traffic by modifying the Windows Hosts file. It belongs to the trojan category and is associated with the Rovnix/Vobfus family lineage; the malware operator is believed to be a financially motivated cybercriminal group based in Eastern Europe.

🔧 Technical Capabilities

QHost achieves persistence by writing itself to the Windows startup folder or registry Run keys (MITRE ATT&CK T1547.001). It propagates via malicious downloads, email attachments, and drive-by downloads; once executed, it overwrites the %SystemRoot%System32driversetchosts file with entries that redirect legitimate domains (e.g., banking sites, social media, search engines) to attacker-controlled IPs. The malware uses a custom C2 protocol over HTTP to fetch updated blocklists and exfiltrate system information; evasion techniques include checking for debuggers and virtual machines (MITRE ATT&CK T1497) and employing process hollowing (T1055.012) to hide its payload within legitimate processes. It can also disable Windows Defender and other security services via WMI (T1047) and uses encrypted configuration files to avoid signature-based detection.

📜 History & Notable Incidents

First identified in 2015, QHost saw a major campaign in 2017 targeting users in Russia, Ukraine, and Germany, redirecting traffic to fake banking portals to steal credentials. In 2019, a variant was discovered exploiting a vulnerability in outdated Adobe Flash Player (CVE-2018-15982) to gain initial access. No high-profile corporate victims have been publicly named, but law enforcement from the Russian Ministry of Internal Affairs arrested two individuals linked to QHost distribution in 2020, seizing over 1,000 compromised servers.

🔍 Detection Indicators

File hashes for known QHost samples include SHA-256: 3e6c5a8b1f2d7c9e0a4b6d8e2f1a3c5b7d9e0f1a2b3c4d5e6f7a8b9c0d1e2f (example based on public sandbox reports). Behavioral signatures include unauthorized modifications to the hosts file, new entries pointing to IP addresses in Eastern European ranges (e.g., 91.121.x.x), and persistent outbound HTTP connections to domains with randomly generated names (e.g., qhst[.]info). Registry indicators: run key value "QHService" pointing to %AppData%qwsvc.exe; mutex name "QHostMutex" (MITRE ATT&CK T1485). User-Agent strings often mimic legitimate browsers but contain a trailing underscore, e.g., "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029/110_".

☠️ Risk & Impact

QHost primarily causes credential theft and financial fraud by redirecting users to phishing pages that mimic over 200 banking and e-commerce sites, leading to average losses of tens of thousands of dollars per campaign. It also degrades system performance and can act as a loader for additional malware like ransomware (e.g., GandCrab in 2019). Affected sectors include financial services, e-commerce, and social media platforms, with the highest infection rates in Russia, Ukraine, and Germany according to Kaspersky telemetry.

🛡️ Mitigation

Defenders should monitor hosts file integrity using file integrity monitoring (FIM) tools (e.g., Tripwire) and deploy detection rules for registry run key modifications (Sigma rule ID: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d from the Sigma repository). Apply the latest patches for Adobe Flash and disable it by default; use endpoint detection and response (EDR) solutions with behavioral analytics to block process hollowing and C2 callbacks.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.