Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with ".Md5.exe", and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.