CyberGlossary

Malware

Stealth Malware

Also known as: Evasive malware, Anti-forensic malware

Definition

Malware specifically engineered to evade detection by users, security tools, and forensic investigators through hiding, mimicry, and anti-analysis tricks.

Stealth malware bundles many evasion techniques: hooking system APIs to hide files and processes, intercepting integrity checks, sandbox and VM detection, anti-debugging, code obfuscation, living-off-the-land binaries, timestomping, and cleaning logs after operation. Rootkits, advanced banking trojans, APT implants and many ransomware loaders fall under this category. Detection relies on EDR with kernel-level visibility, memory forensics, network traffic analysis, threat hunting on TTPs (via frameworks like MITRE ATT&CK), and tamper-evident logging shipped off-host. Hardening includes Secure Boot, signed drivers, least privilege and reducing dwell time through proactive hunting.

Examples

  • TDL/TDSS rootkits hiding their files from Windows APIs.
  • Cobalt Strike Beacon configurations that detect sandboxes and unhook EDR.

Related terms