Technique:  Hide Artifacts:Hidden Files and Directories
Agent Tesla has created hidden folders.
AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings.
It has saved files with hidden file attributes.
It's macOS backdoor hides the clientID file via a chflags function.
Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.
BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.
Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
Carberp has created a hidden file in the Startup folder of the current user.
ccf32 has created a hidden directory on targeted systems, naming it after the current local time (year, month, and day).
Clambling has the ability to set its file attributes to hidden.
CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc, /private/tmp/.info.py, /private/tmp/.server.sh, ~/Library/LaunchAgents/.espl.plist, ~/Library/Containers/.[random string]/[random string].
Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.
EnvyScout can use hidden directories and files to hide malicious executables.
Explosive has commonly set file and path attributes to hidden.
It has created hidden files and folders within a compromised Linux system /tmp directory. It also has used attrib.exe to hide gathered local host information.
FruitFly saves itself with a leading "." to make it a hidden file.
It has hidden files on a compromised host.
iKitten saves itself with a leading "." so that it's hidden from users by default.
Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden.
InvisiMole can create hidden system directories.
Ixeshe sets its own executable file's attributes to hidden.
The Komplex payload is stored in a hidden directory at /Users/Shared/.local/kextd.
It has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.
Lokibot has the ability to copy itself to a hidden file and directory.
LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".
It has used malware to store malicious binaries in hidden directories on victim's USB drives.
It has the capability to exfiltrate stolen data to a hidden folder on a removable drive.
MacSpy stores itself in ~/Library/.DS_Stores/
Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.
It's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data.
NETWIRE can copy itself to and launch itself from hidden folders.
Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.
OSX/Shlayer has executed a .command script from a hidden directory in a mounted DMG.
OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden.
PlugX can modify the characteristics of folders to hide them from the compromised user.
PoetRAT has the ability to hide and unhide files.
QakBot has placed its payload in hidden subdirectories.
QuasarRAT has the ability to set file attributes to "hidden" to hide files from the compromised user's view in Windows File Explorer.
Rising Sun can modify file attributes to hide files.
It downloaded a file "libprocesshider", which could hide files on the target system.
SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim.
SysUpdate has the ability to set file attributes to hidden.
ThiefQuest hides a copy of itself in the user's ~/Library directory by using a . at the beginning of the file name followed by 9 random characters.
It can hide legitimate directories and replace them with malicious copies of the same name.
It has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\.
WannaCry uses attrib +h to make some of its files hidden.
WastedLocker has copied a random file from the Windows System32 folder to the %APPDATA% location under a different hidden filename.
XCSSET uses a hidden folder named .xcassets and .git to embed itself in Xcode.