Procedure examples

COATHANGER creates and installs itself to a hidden installation directory.

NETWIRE can copy itself to and launch itself from hidden folders.

iKitten saves itself with a leading "." so that it's hidden from users by default.

EnvyScout can use hidden directories and files to hide malicious executables.

Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive.

Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.

Cuckoo Stealer has copied its binary and the victim's scraped password into a hidden folder in the `/Users` directory.

WastedLocker has copied a random file from the Windows System32 folder to the %APPDATA% location under a different hidden filename.

InvisiMole can create hidden system directories.

CLAIMLOADER has modified file attributes to remain hidden to a standard user.

FruitFly saves itself with a leading "." to make it a hidden file.

Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.

REPTILE has the ability to communicate with the kernel-mode component to hide files.

Rising Sun can modify file attributes to hide files.

PlugX can modify the characteristics of folders to hide them from the compromised user. PlugX has also modified file attributes to hidden and system.

Explosive has commonly set file and path attributes to hidden.

Clambling has the ability to set its file attributes to hidden.

DarkGate initial installation involves dropping several files to a hidden directory named after the victim machine name. Additionally, DarkGate uses attrib to hide a directory in the following command: ` C:\Windows\system32\attrib.exe” +h C:/rjtu/`.

ThiefQuest hides a copy of itself in the user's ~/Library directory by using a . at the beginning of the file name followed by 9 random characters.

WannaCry uses attrib +h to make some of its files hidden.

Ixeshe sets its own executable file's attributes to hidden.

Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.

Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.

ccf32 has created a hidden directory on targeted systems, naming it after the current local time (year, month, and day).

OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden.

Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.

Carberp has created a hidden file in the Startup folder of the current user.

SysUpdate has the ability to set file attributes to hidden.

BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.

Lokibot has the ability to copy itself to a hidden file and directory.

PoetRAT has the ability to hide and unhide files.

CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc, /private/tmp/.info.py, /private/tmp/.server.sh, ~/Library/LaunchAgents/.espl.plist, ~/Library/Containers/.[random string]/[random string].

HIUPAN has modified registry keys to ensure hidden files and extensions are not visible through the modification of `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced`.

XCSSET uses a hidden folder named .xcassets and .git to embed itself in Xcode.

AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings.

Agent Tesla has created hidden folders.

QakBot has placed its payload in hidden subdirectories.

The Komplex payload is stored in a hidden directory at /Users/Shared/.local/kextd.

OSX/Shlayer has executed a .command script from a hidden directory in a mounted DMG.

MacSpy stores itself in ~/Library/.DS_Stores/

LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".

SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim.

attrib can be used to make files or directories hidden.

Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden.

QuasarRAT has the ability to set file attributes to "hidden" to hide files from the compromised user's view in Windows File Explorer.

TeamPCP Cloud Stealer can create a hidden directory in the user's home folder on Linux hosts to write a python backdoor.