Darkhotel
DarkHotel is malware/tooling referenced as part of historically notable advanced espionage malware sets. In the provided content, DarkHotel is described as using anti-analysis and host reconnaissance techniques. Specifically, it employs just-in-time decryption of strings to evade sandbox detection, and it decrypts strings and imports with RC4 during execution. It also collects the victim machine’s IP address and network adapter information. The content does not provide a specific infection vector, targeted industries, associated threat actor beyond the DarkHotel naming, or concrete indicators of compromise.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Stealth
1 technique"...macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload." / "...involved the use of Base64 obfuscated scripts and commands." / "...deobfuscated Base64-encoded commands..." | "...ability to decrypt AES encrypted payloads." / "...used RC4 algorithm to decrypt configuration data." / "...unpack itself into memory using XOR."
Discovery
1 technique"...used tasklist to enumerate processes..."; "...used the ps command to list processes..."; "...calling CreateToolhelp32Snapshot... to enumerate the running processes..."
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as one of the notable advanced malware/toolsets frequently analyzed in earlier public research.
Uses just-in-time string decryption to evade sandbox detection.
Malware associated with DarkHotel activity that collects IP and network adapter information from victims.
Malware associated with Darkhotel activity that uses just-in-time string decryption to evade sandbox detection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.