1

I went through the help pages of VT and VT Intelligence, saw documentation about most tags, but couldn't find anything about the "hosts-modifier" tag, can anyone explain to me what does it mean?

2

It means the malware tries to modify the file named "hosts" (located inside "C:\windows\system\drivers\etc\"), in an attempt to alter the address the system will use to communicate with a specific DNS name.

For example, by adding the entry

127.0.0.1   update.microsoft.com

your system will always know that the IP address for "update.microsoft.com" is "127.0.0.1", and it would not need to make requests to DNS servers for that domain address.

The DNS name he tries to put there is stated under "Behavioural information", as you may see in this example.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.