Loading malware…
Asruex is a Windows backdoor known since 2015 and associated with the DarkHotel cyberespionage operation. Its capabilities include remote access through command-and-control infrastructure, keystroke logging, password theft, and data theft. Some variants also function as file infectors, modifying PDF documents, Word documents, and executable files.
File-infecting variants exploit CVE-2010-2883 in Adobe Reader and Acrobat and CVE-2012-0158 in Microsoft Office to execute malicious code when infected documents are opened in vulnerable software. They display the original document or execute the original application alongside the malicious payload to conceal infection. Asruex has spread through malicious shortcuts containing PowerShell download scripts, removable drives, and network drives. Its components perform anti-debugging and sandbox-detection checks and inject a malicious DLL into a legitimate Windows process to provide infection and backdoor functionality.
In 2026, Asruex was identified in a compromised Realtek LAN driver installer hosted on a legacy GEEKOM support page. Executing the installer could give the malware administrator-level permissions on affected Windows systems. This exposure involved a downloadable software package rather than factory-preinstalled malware; GEEKOM removed the affected package. The mechanism by which the installer became compromised has not been established.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Asruex ... can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883 ... As mentioned earlier, it uses a specially crafted template to exploit the CVE-2012-0158 vulnerability to infect Word documents. The CVE-2012-0158 vulnerability allows possible attackers to execute an arbitrary code remotely through a Word document or web site. | Since it first emerged in 2015, Asruex has been known for its backdoor capabilities and connection to the spyware DarkHotel. However, when we encountered Asruex in a PDF file, we found that a variant of the malware can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883, which inject code in Word and PDF files respectively.
Asruex ... can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883, which inject code in Word and PDF files respectively... This behavior is due to a specially crafted template that takes advantage of the CVE-2010-2883 vulnerability while appending the host file. The vulnerability is found in the strcat function of Adobe’s CoolType.dll... it can cause a stack buffer overflow to execute its shellcode. | Since it first emerged in 2015, Asruex has been known for its backdoor capabilities and connection to the spyware DarkHotel. However, when we encountered Asruex in a PDF file, we found that a variant of the malware can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883, which inject code in Word and PDF files respectively.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
it has been reported that DarkHotel has used Asruex since 2015 to attack isolated networks; however, publicly available reports do not provide enough technical evidence demonstrating the presence of the minimal requirements needed to satisfy our working definition.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Asruex infects a system through a shortcut file that has a PowerShell download script
DarkHotel has repeatedly demonstrated its capabilities of developing exploits for 0day vulnerabilities in software such as Google Chrome, Mozilla Firefox, Internet Explorer, and Windows Kernel. The exploits are leveraged to deliver malware that can provide backdoor access and remote control over the target device.
The executable file also injects the DLL c982d2ab066c80f314af80dd5ba37ff9dd99288f ... into a legitimate Windows process memory.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor malware embedded in a compromised LAN driver that ran with administrator privileges, enabling keystroke logging, password theft, data interception, and communication with a command-and-control network.
A trojan detected within a downloadable Realtek LAN driver installer hosted on a legacy GEEKOM support page, creating a malware delivery route through a seemingly legitimate driver package.
Reported in a downloadable Realtek LAN driver installer hosted on an obsolete GEEKOM support page that remained accessible through search engines. Exposure was limited to users who downloaded or executed that package; GEEKOM reported no similar issue on current support pages and said its pre-installed Windows images did not contain the flagged file. The content does not describe Asruex's capabilities or establish how the installer became infected.
A backdoor embedded in a Geekom LAN driver installer that would run with administrator privileges, steal data, intercept keystrokes, retrieve passwords, and connect to command-and-control servers for remote access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.