Rootkits are malicious applications that hide on a computer and allow an attacker to secretly perform actions on an attacked object. The rootkit code is usually hidden deep in the operating system and is coded in such a way as to avoid detection by antiviruses and other security tools. The rootkit contains various malicious tools, such as keyloggers, saved passwords, a bank card data scanner, remotely controlled software for carrying out DDoS attacks, as well as functions for deactivating antiviruses.

Rootkits are divided into two types: user-level and kernel-level. The former gets the rights of a regular application, inject themselves into other running processes, and use their memory. This is the more common option. In the case of kernel-level rootkits, it has almost endless possibilities. Kernel-level rootkits are usually more difficult to create and therefore less common. They are also much more difficult to detect and delete.