value:  Carberp has created a hidden file in the Startup folder of the current user. ;; CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc /private/tmp/.info.py /private/tmp/.server.sh ~/Library/LaunchAgents/.espl.plist ~/Library/Containers/.[random string]/[random string]. ;; Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application. ;; Explosive has commonly set file and path attributes to hidden. ;; FruitFly saves itself with a leading ." to make it a hidden file. ;; iKitten saves itself with a leading "." so that it's hidden from users by default. ;; Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden. ;; InvisiMole can create hidden system directories. ;; Ixeshe sets its own executable file's attributes to hidden. ;; The Komplex payload is stored in a hidden directory at /Users/Shared/.local/kextd. ;; Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application. ;; Lokibot has the ability to copy itself to a hidden file and directory. ;; LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden". ;; Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive. ;; MacSpy stores itself in ~/Library/.DS_Stores/ ;; Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each. ;; Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data. ;; NETWIRE can copy itself to and launch itself from hidden folders. ;; Before exfiltration Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands. ;; OSX/Shlayer executes a .command script from a hidden directory in a mounted DMG. ;; OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden. ;; PoetRAT has the ability to hide and unhide files. ;; Rising Sun can modify file attributes to hide files. ;; Rocke downloaded a file "libprocesshider" which could hide files on the target system. ;; SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim. ;; ThiefQuest hides a copy of itself in the user's ~/Library directory by using a . at the beginning of the file name followed by 9 random characters. ;; Tropic Trooper has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\. ;; WannaCry uses attrib +h to make some of its files hidden."
name: Hide Artifacts: Hidden Files And Directories