Procedure examples

Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.

REPTILE has the ability to communicate with the kernel-mode component to hide files.

Rising Sun can modify file attributes to hide files.

PlugX can modify the characteristics of folders to hide them from the compromised user. PlugX has also modified file attributes to hidden and system.

Explosive has commonly set file and path attributes to hidden.

Clambling has the ability to set its file attributes to hidden.

DarkGate initial installation involves dropping several files to a hidden directory named after the victim machine name. Additionally, DarkGate uses attrib to hide a directory in the following command: ` C:\Windows\system32\attrib.exe” +h C:/rjtu/`.

ThiefQuest hides a copy of itself in the user's ~/Library directory by using a . at the beginning of the file name followed by 9 random characters.

WannaCry uses attrib +h to make some of its files hidden.

Ixeshe sets its own executable file's attributes to hidden.

Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.

Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.

ccf32 has created a hidden directory on targeted systems, naming it after the current local time (year, month, and day).

OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden.

Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.

Carberp has created a hidden file in the Startup folder of the current user.

SysUpdate has the ability to set file attributes to hidden.

BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.

Lokibot has the ability to copy itself to a hidden file and directory.

PoetRAT has the ability to hide and unhide files.

CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc, /private/tmp/.info.py, /private/tmp/.server.sh, ~/Library/LaunchAgents/.espl.plist, ~/Library/Containers/.[random string]/[random string].

HIUPAN has modified registry keys to ensure hidden files and extensions are not visible through the modification of `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced`.

XCSSET uses a hidden folder named .xcassets and .git to embed itself in Xcode.

AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings.

Agent Tesla has created hidden folders.

QakBot has placed its payload in hidden subdirectories.

The Komplex payload is stored in a hidden directory at /Users/Shared/.local/kextd.

OSX/Shlayer has executed a .command script from a hidden directory in a mounted DMG.

MacSpy stores itself in ~/Library/.DS_Stores/

LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".

SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim.

attrib can be used to make files or directories hidden.

Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden.

QuasarRAT has the ability to set file attributes to "hidden" to hide files from the compromised user's view in Windows File Explorer.

TeamPCP Cloud Stealer can create a hidden directory in the user's home folder on Linux hosts to write a python backdoor.

SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.

TrickBot has used a hidden VNC (hVNC) window to monitor the victim and collect information stealthily.

QuietSieve has the ability to execute payloads in a hidden window.

AvosLocker has hidden its console window by using the `ShowWindow` API function.

WindTail can instruct the OS to execute an application without a dock icon or menu.

Ursnif droppers have used COM properties to execute malware in hidden windows.

Tsundere Botnet’s MSI installer has used `-WindowStyle Hidden` to hide Tsundere Botnet’s execution from the user.

InvisibleFerret has executed Python instances of the browser module “.n2/bow” utilizing the `CREATE_NO_WINDOW` process creation flag.

SharpDisco can hide windows using `ProcessWindowStyle.Hidden`.

StrongPity has the ability to hide the console window for its document search module from the user.

Medusa Ransomware has utilized the `ShowWindow` function to hide current window.

BOOKWORM has created a hidden window when conducting key logging and clipboard theft through its KBLogger.dll module.

HAMMERTOSS has used -WindowStyle hidden to conceal PowerShell windows.

IMAPLoader hides the Windows Console window created by its execution by directly importing the `kernel32.dll` and `user32.dll` libraries `GetConsoleWindow` and `ShowWindow` APIs.

SystemBC has utilized the `-WindowStyle Hidden -ep bypass -file `to conceal PowerShell windows.