The woman with the acronym 'LOL' on her shirt who was arrested this week in connection with the murder of North Korea's Kim Jong-nam stayed in cheap hotels, carried a wad of cash and cut her hair a day before the brazen attack at KLIA2.

According to the receptionist at one of the hotels, a woman who had checked in under the Vietnamese name of Doan Thi Huong on Sunday Feb 12 left early in the morning on Monday, the day of the assassination, and returned later, showing no signs of stress.

Police believe she was the person who, at around 8.20am that day, had approached the estranged half-brother of North Korean leader Kim Jong-un from behind at the Malaysian capital's budget airline terminal and thrust a deadly poisonous substance into his face.

According to Malaysian media reports, Doan told police she had been duped into what she thought was a harmless practical joke. A second woman who has been detained, an Indonesian national, also thought she was involved in a prank, some media reports said.

However, staff at two hotels in a rundown area near the airport gave details of Doan's movements before the killing that appeared both calm and deliberate.

A private investigator told Reuters her behaviour bore the hallmarks of an intelligence operative.

A stack of money, haircut

Doan went first to the two-star Qlassic Hotel, checking in on Saturday, Feb 11. A staff member who asked not to be named said she stayed in the cheapest room, which had no windows.

"I remember she had wanted to extend her stay here, and was ready to pay with a stack of money in her hand," said another member of the Qlassic's staff, a front-desk employee who only identified herself as Sia.

After one night, Doan checked into the CityView Hotel, arriving with a suitcase, a backpack and a large teddy bear, the receptionist told Reuters, declining to be named. She said Doan spoke understandable English.

She borrowed a pair of scissors from the front desk the evening before the attack, and a member of housekeeping staff found hair on the floor and in the waste basket the next day.

"She found the scissors on the room desk. And there was hair strewn on the floor in the room, (Doan) had thrown some in the bin but there was still a mess," the receptionist said.

She said that the next day Doan had on the shirt she was seen wearing in an airport CCTV grab that has earned her the nickname 'LOL Girl' in Malaysian media.

Doan was out for much of the morning and, on her return, she seemed "relaxed" and "didn't look angry or worried".

Doan complained about the Wifi in her room and when she was told it couldn't be fixed until the afternoon, she checked out and left.

She then checked into the SkyStar Hotel, also nearby, and left after one night, an employee said.

It is not known where Doan went next. Police said she was arrested on Wednesday morning, about 48 hours after the murder, in the same terminal where Kim Jong Nam was attacked.

"If you ask me, do her movements indicate that she was an intelligence operative, then I would say yes," said a private investigator in Kuala Lumpur who asked not to be named.

"That is how they operate. Change of appearance, cash transactions, no paper trail and constantly on the move."

Second woman from Jakarta slum

The Indonesian woman who was arrested on Thursday, Siti Aishah, had lived a quiet life in a slum district of Jakarta before going to find work in Malaysia, residents in the western neighbourhood of the Indonesian capital said.

According to Malaysian media reports, she stood in front of Kim to distract him while her accomplice approached from behind.

In Jakarta, Aishah had worked for a time in the tailoring business in the house of her ex-husband's family, sewing clothes by hand, former neighbours in the Tambora district said.

"I can't believe the news. Her background was very simple," said community leader R Yusri.

The couple moved to Malaysia several years ago but separated in 2012. Aishah's former father-in-law said she had returned to Jakarta on Jan 28 to visit her seven-year-old son.

She had looked thinner than usual and had a cough.

The streets in Tambora district are too narrow for cars to pass through. A tangle of washing lines hangs above small concrete and makeshift homes, many housing small businesses or selling clothes and food.

Ida Anisafitri, a neighbour, said Aishah kept a low profile when she visited there.

"We would see her briefly with the child and then she would go back inside the house," Anisafitri said, as a loudspeaker from a nearby mosque sounded with the call to prayer.

- Reuters