1

I was just wondering if it was possible for malware to hide itself in this way.

2

1 Answer 1

4

Yes, it is possible for malware to hide itself from view to the OS itself, via a number of mechanisms, including filtering the output from the API calls that show processes in Task Manager.

This class of malware is usually called a rootkit, and is designed primarily to allow an adversary to keep access to a system long-term (called an advanced persistent threat, or APT) by hiding their actions and allowing the adversary to recover access if (partially) discovered. They act as a platform for further attacks on the system like installing keyloggers, spyware, sabotaging system software, or whatever else tickles the attackers fancy.

Rootkits must operate at a very low level in the OS architecture in order to do what they do, so malignant drivers and maliciously patched kernel libraries are generally involved in the better ones.

Not the answer you're looking for? Browse other questions tagged .