{
  "family": "houndhack",
  "sample_count": 34,
  "category": "rat",
  "description": "Houndhack (cataloged in anti-malware databases and threat encyclopedias as HackTool:Win32/HoundHack, Backdoor:Win32/HoundHack, and Trojan.HoundHack) is a historic Windows remote administration tool and hacktool active in the underground hacker community since the mid-2000s. Originally released as an offensive post-exploitation and remote surveillance utility, Houndhack combines features of a classic Remote Access Trojan (RAT) with network scanning and port exploitation modules. Once installed on a host, Houndhack establishes a hidden TCP server or initiates a reverse TCP connection to attacker infrastructure. It empowers remote operators to perform keystroke logging, capture screen images, manipulate running processes, browse and transfer local files, edit the Windows registry, and launch localized denial-of-service (DoS) or port scanning attacks against adjacent network nodes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/HoundHack",
    "Backdoor:Win32/HoundHack",
    "Trojan.HoundHack",
    "Win32/HoundHack",
    "HackTool.HoundHack",
    "HoundHack RAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HackTool:Win32/HoundHack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Houndhack is a legacy Windows remote administration tool (RAT) and hacktool used for unauthorized remote system surveillance and control."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance features does Houndhack provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Houndhack supports keystroke logging, screen capture, file transfers, registry editing, and remote command shell execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does Houndhack establish remote communication?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It can operate as a listening TCP server on custom ports or establish reverse TCP connections back to an attacker's IP address."
      }
    },
    {
      "@type": "Question",
      "name": "What network attack features are included in Houndhack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Houndhack includes built-in network port scanning utilities and basic denial-of-service flooding routines."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Houndhack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy endpoint protection to detect known RAT server stubs, block non-standard listening ports at host firewalls, and monitor for unauthorized autostart registry entries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1046",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2005,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Executable Attachments",
    "P2P Hacker Tool Archives",
    "Direct Server Exploitation"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows XP",
    "Windows Server 2003",
    "Windows 2000"
  ],
  "capabilities": [
    "Remote Interactive Command Shell",
    "Keystroke Logging & Screen Capture",
    "File System Exploration & File Transfer",
    "Local Network Port Scanning",
    "Registry Manipulation & Process Control"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi/C++)",
      "Server Stub"
    ],
    "network_signatures": [
      "Outbound and inbound TCP traffic on custom ports (such as port 5555 or 7777) carrying unencrypted plaintext or simple XOR command packets",
      "High-velocity TCP SYN probes generated during network port scanning activities"
    ],
    "evasion_techniques": [
      "Disguising server binary names as native Windows services (such as winlogon.exe or taskmgr.exe)",
      "Injecting backdoor listener threads into active Windows processes"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d",
      "0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e"
    ],
    "registry_keys": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HoundHackServer",
      "HKCU\\Software\\HoundHack"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\houndhack.exe",
      "%Temp%\\hh_server.exe",
      "%AppData%\\HoundHack\\logs.txt"
    ]
  },
  "defensive_measures": [
    "Configure host firewalls to block unsolicited inbound TCP connections on non-standard ports",
    "Monitor network traffic for internal port scanning and high-frequency SYN packets originating from internal endpoints",
    "Utilize modern EDR solutions to detect keyboard hook API registrations (SetWindowsHookEx)"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - HackTool:Win32/HoundHack",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/HoundHack"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - HackTool.Win32.HoundHack",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "HackTool:Win32/HoundHack.A",
      "Backdoor:Win32/HoundHack.gen"
    ]
  },
  "motivation": "Post-Exploitation, Network Espionage & Unauthorized Remote Administration",
  "sample_hashes": []
}