Loading malware…
DarkHotel is a long-running espionage malware operation and associated spyware toolkit known for targeting Windows systems, particularly in high-value intrusion campaigns. It has been linked in public reporting to the DarkHotel threat cluster and is frequently discussed in the context of targeted surveillance activity against business travelers, government-related targets, and other strategically selected victims in Asia and beyond. Attribution to a specific state sponsor remains contested in some reporting, but the operation is widely treated as an advanced persistent threat.
DarkHotel malware has been observed using keylogging to capture user input and collect sensitive information from infected hosts. It also performs host and network reconnaissance, including gathering the victim system’s IP address and network adapter information. Samples have used RC4 to decrypt strings and imports at runtime, and have employed just-in-time decryption of strings as an anti-analysis measure intended to hinder sandbox detection and static inspection. Reporting also notes reuse of the ImprovedReflectiveDllInjection library, indicating support for in-memory loading or injection tradecraft within the broader toolset.
Operationally, DarkHotel has been associated with delivery through spoofed software installers, especially fake Flash Player updates served from compromised infrastructure or watering-hole style compromises. Campaigns using this approach selectively profiled visitors and only exposed payloads to systems meeting specific conditions, reflecting a targeted infection model rather than indiscriminate mass distribution. DarkHotel has also been referenced in connection with related malware such as Asruex, which has been described as linked to the same spyware ecosystem.
Overall, DarkHotel is best characterized as a Windows spyware and backdoor platform used in targeted espionage operations, combining credential and activity collection with reconnaissance and defense-evasion techniques.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
An example is the quick adoption by DarkHotel of a Flash zero-day found in the reckless full release of the HackingTeam trove [1].
8 distinct techniques documented for this family, organized by ATT&CK tactic.
IoCs include services such as WOWmanager service, TlbControl service, WinMI32 service, HP003044 service, NetBIOS2010 service, pnppci service, ethio service, ntdos505 service.
IoCs include services such as WOWmanager service, TlbControl service, WinMI32 service, HP003044 service, NetBIOS2010 service, pnppci service, ethio service, ntdos505 service.
SIG4 ... Snake/Uroburos ... fdisk.sys driver ... SIG35 ... most likely related to Duqu ... looks for kernel driver ... SIG8 StuxNet ... mrxcls.sys, mrxnet.sys, s7otbxdxa.sys drivers.
APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
IoCs include services such as mrxcls service, WinMI32 service, HP003044 service, NetBIOS2010 service, pnppci service, ethio service, ntdos505 service.
"...used tasklist to enumerate processes..."; "...used the ps command to list processes..."; "...calling CreateToolhelp32Snapshot... to enumerate the running processes..."
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.
They check for the existence of specific files, windows registry entries, and other signs ... For example, this script looks for the existence of an actual file “winver32.exe” in the very specific $docsandsettings\\$subkey\\Application Data\\winver32.exe path.
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.