Contents
Campaign: Houselet-GoLoader-PlayStationRemotePlay
Date: 2025-11-17
Author: The Hunters Ledger
License: CC BY 4.0
Reference: https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet/
Execution Layer
Suspicious Process Execution from Temp
This rule looks for executions of houselet.exe from the Temp directory, which is highly unusual for legitimate software.
title: Houselet.exe Execution From Temp Directory
id: 7c3a1e2b-4f6d-4a89-9c1e-2b8d5f3a7e91
status: experimental
description: >-
Detects execution of houselet.exe from the user's AppData\Local\Temp directory.
Houselet is a Go-based loader distributed as a fake PlayStation Remote Play
installer; execution from Temp is consistent with a user running a downloaded
dropper and is highly unusual for legitimate, vendor-signed software.
references:
- https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet/
author: The Hunters Ledger
date: '2025-11-17'
tags:
- attack.execution
- attack.t1204.002
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains: '\AppData\Local\Temp\houselet.exe'
condition: selection
falsepositives:
- Legitimate portable applications intentionally run from the Temp directory (uncommon)
level: high
Suspicious Self-Spawn Behavior
Malware often respawns itself to evade termination. This rule detects houselet.exe spawning itself with explorer.exe as parent.
title: Houselet.exe Relaunched With Explorer.exe as Parent
id: 9e2d4a6c-1b3f-4e58-8a7d-6c9f2e1b4d3a
status: experimental
description: >-
Detects houselet.exe being launched with explorer.exe as the parent process.
Houselet respawns itself to survive termination attempts; a second instance
parented by explorer.exe (rather than the original delivery vector) is
consistent with a logon-triggered relaunch from a persistence mechanism such
as a Registry Run key or Startup folder entry.
references:
- https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet/
author: The Hunters Ledger
date: '2025-11-17'
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.001
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\explorer.exe'
Image|endswith: '\houselet.exe'
condition: selection
falsepositives:
- Unlikely
level: high
Persistence Layer
Registry Modification for IE ZoneMap
Houselet modifies Internet Explorer ZoneMap keys to bypass restrictions. This rule flags suspicious registry changes.
title: Internet Explorer ZoneMap Registry Modification
id: 5f8b2d4e-3a7c-4e91-9b6d-1c4a8f2e6b7d
status: experimental
description: >-
Detects modification of Internet Explorer Internet Settings ZoneMap registry
keys. Houselet writes to these keys to weaken Internet Zone security
restrictions, easing follow-on download or execution steps.
references:
- https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet/
author: The Hunters Ledger
date: '2025-11-17'
tags:
- attack.defense-impairment
- attack.persistence
- attack.t1112
- detection.emerging-threats
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap'
condition: selection
falsepositives:
- Administrative scripts or group policy that legitimately manage Internet Zone security settings
level: medium
Registry Modification for Proxy Settings
The malware alters proxy settings to hide traffic. This rule detects changes to proxy-related registry keys.
title: Internet Settings Proxy Registry Modification
id: 2a6c8e4d-7b1f-4d93-8e5a-3f7c1b9d4e6a
status: experimental
description: >-
Detects modification of Internet Settings proxy-related registry keys.
Houselet alters these values to reroute or obscure the victim's outbound
web traffic.
references:
- https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet/
author: The Hunters Ledger
date: '2025-11-17'
tags:
- attack.defense-impairment
- attack.persistence
- attack.t1112
- detection.emerging-threats
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy'
condition: selection
falsepositives:
- Legitimate proxy configuration changes made by IT-managed software or the user
level: medium
Network Layer
Suspicious HTTP POST to PHP Endpoint
Legitimate installers rarely POST to PHP scripts. This rule detects outbound POST requests to PHP endpoints.
title: HTTP POST Request to PHP Endpoint From Houselet Host
id: 8d4f6b2a-9c1e-4a75-8b3d-6e2a9f4c1d8b
status: experimental
description: >-
Detects an HTTP POST request to a .php URI. Houselet beacons to its
command-and-control backend via POST requests to a PHP-based endpoint;
legitimate installer or update traffic rarely posts directly to a raw
PHP script.
references:
- https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet/
author: The Hunters Ledger
date: '2025-11-17'
tags:
- attack.command-and-control
- attack.t1071.001
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
c-uri|endswith: '.php'
cs-method: 'POST'
condition: selection
falsepositives:
- Legitimate web applications or update mechanisms that submit data to a PHP backend
level: high
Outbound Traffic to Known C2 IP
This rule directly monitors traffic to the known C2 IP 45.155.69.25.
title: Outbound Traffic to Houselet C2 IP 45.155.69.25
id: 1b3d5f7a-8c2e-4b64-9a1d-7f3e5c8a2d6b
status: experimental
description: >-
Detects outbound network traffic to 45.155.69.25, a confirmed Houselet
command-and-control IP address. Any connection to this address from an
enterprise endpoint is a high-confidence compromise indicator.
references:
- https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet/
author: The Hunters Ledger
date: '2025-11-17'
tags:
- attack.command-and-control
- attack.t1071.001
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
dst_ip: '45.155.69.25'
condition: selection
falsepositives:
- Unlikely
level: critical
Memory & Crypto Layer
RWX Memory Allocation
Houselet allocates memory with Read/Write/Execute permissions for in-memory payloads. This rule detects RWX allocations.
Status: No standalone Sigma rule shipped — see Coverage Gaps below.
The original rule keyed on a CallTrace|contains: "VirtualAlloc" selector under category: sysmon. Neither sysmon (a product/service name, not a Sigma logsource category) nor CallTrace (not a field exposed by any standard Sigma-mapped log source — Sysmon’s process_creation event does not carry a per-call API trace) is valid, and no other distinguishing selector (command-line argument, target image, injected-process identity) is documented for this behavior. Inventing a substitute field would misrepresent what is actually observable in standard Windows telemetry. This gap and the remediation path are documented in Coverage Gaps.
Use of Cryptographic Functions
The malware uses AES, RC4, and Base64 for obfuscation. This rule detects suspicious crypto API calls.
Status: No standalone Sigma rule shipped — see Coverage Gaps below.
The original rule keyed on CallTrace|contains matching CryptEncrypt/CryptAcquireContext/BCryptEncrypt under category: sysmon, which has the same field-validity problem as the RWX rule above. This gap and the remediation path are documented in Coverage Gaps.
Evasion & Impersonation Layer
Fake Sony Metadata
Houselet pretends to be a Sony installer. This rule detects binaries with Sony metadata but unsigned/self-signed certificates.
title: Unsigned Process With Sony Interactive Entertainment PE Description
id: 4e6a8c2d-1f3b-4d57-9a6e-8b1d4f2a7c9e
status: experimental
description: >-
Detects a running process whose PE version-info Description field claims
Sony Interactive Entertainment authorship while the process is not signed
or carries an untrusted signature. Houselet is distributed as a fake
PlayStation Remote Play installer using this exact metadata combination
to appear legitimate at a glance.
references:
- https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet/
author: The Hunters Ledger
date: '2025-11-17'
tags:
- attack.stealth
- attack.t1036.001
- detection.emerging-threats
logsource:
category: image_load
product: windows
detection:
selection:
Description|contains: 'Sony Interactive Entertainment'
filter_signed:
Signed: 'true'
SignatureStatus: 'Valid'
condition: selection and not filter_signed
falsepositives:
- A genuine Sony-signed binary evaluated in an environment where signature metadata is not populated or logged correctly
level: medium
Anti-VM Checks
The malware performs anti-VM checks. This rule detects suspicious registry or process queries typical of VM detection.
title: Houselet Command Line Referencing Virtualization Artifacts
id: 6c8e2a4f-3d1b-4e79-8c5a-2f9b7d1e4a6c
status: experimental
description: >-
Detects houselet.exe with a command line referencing common virtualization
or sandbox process/service names (VBoxService, vmtoolsd, qemu). Houselet
performs anti-VM checks as part of its sandbox-evasion routine before
proceeding with follow-on loader activity.
references:
- https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet/
author: The Hunters Ledger
date: '2025-11-17'
tags:
- attack.stealth
- attack.discovery
- attack.t1497.001
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\houselet.exe'
CommandLine|contains:
- 'VBoxService'
- 'vmtoolsd'
- 'qemu'
condition: selection
falsepositives:
- Unlikely — these strings are hardcoded VM-artifact names, not something a benign houselet.exe invocation would reference
level: medium
Coverage Gaps
Gap 1: RWX Memory Allocation and Crypto API Usage — No Sigma Rule Possible From Documented Evidence
Status: Gap — behavior confirmed in analysis; no standard-telemetry Sigma rule can express it without inventing a field.
Two behaviors are documented in the malware analysis but could not be converted into valid Sigma rules: (1) allocation of Read/Write/Execute memory via VirtualAlloc for staging in-memory payloads, and (2) use of CryptEncrypt/CryptAcquireContext/BCryptEncrypt for AES/RC4/Base64-based obfuscation. Both were originally keyed on a CallTrace field under a sysmon logsource category — neither is valid Sigma: sysmon is a product/service name, not a logsource category, and no standard Windows telemetry source (Sysmon process_creation, image_load, or otherwise) exposes a per-call in-process API trace field. Detecting this class of behavior requires EDR-level API-hooking telemetry or ETW-based instrumentation, which is vendor-specific and outside the standard Sigma field taxonomy.
What would enable coverage: A specific, distinguishing command-line argument, injected target-process identity, or named pipe/section-object artifact tied to the RWX allocation or crypto routine — something a standard Sysmon deployment can natively log. Absent that, this behavior is best hunted with EDR-native API-call monitoring rather than a generic Sigma rule.
Gap 2: Anti-VM Registry Queries — Process-Only Coverage
Status: Partial — the shipped rule covers command-line references to virtualization artifacts; registry-based VM detection queries are not separately covered.
The malware analysis references both “registry or process queries typical of VM detection.” The shipped rule (Houselet Command Line Referencing Virtualization Artifacts) covers the process/command-line half via VBoxService/vmtoolsd/qemu string matches. No specific registry key path was documented for the registry-query half of this behavior, so no registry_event rule was authored — adding one would require inventing a key path not present in the source analysis.
What would enable coverage: The specific registry key(s) or value(s) Houselet queries during its anti-VM check (e.g., a HKLM\HARDWARE\Description\System BIOS-string read or a SYSTEM\CurrentControlSet\Services\VBoxGuest presence check) would allow a registry_event rule keyed on EventType: QueryValue against that exact path.
License
Detection rules are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Free to use, including commercially, with attribution to The Hunters Ledger.