Introduction
Malware frequently creates files on compromised systems. These files may support persistence, data theft, command-and-control communications, credential harvesting, ransomware operations, or concealment activities.
From a digital forensics perspective, the creation of unauthorized files is one of the most valuable indicators of compromise because it produces artefacts that can be identified, timestamped, analysed, and correlated with malicious activity.
Both desktop operating systems and mobile platforms generate extensive metadata regarding file creation, modification, execution, and deletion. Understanding why malware creates files and where these files reside is essential for incident response, malware analysis, and forensic investigations.
Why Malware Creates Files
Malicious software commonly creates files for several reasons:
- Persistence across reboots.
- Storage of stolen data.
- Configuration information.
- Encryption keys.
- Additional malware modules.
- Log files.
- Command-and-control instructions.
- Temporary execution components.
- Data exfiltration staging.
- Anti-forensic operations.
The creation of files often provides investigators with evidence regarding:
- Initial infection time.
- Malware execution.
- User interaction.
- Privilege escalation.
- Data theft.
- Lateral movement.
- Persistence mechanisms.
Malware Categories That Create Files
1. Computer Viruses
Traditional computer viruses infect legitimate executable files.
Examples include:
- Boot sector viruses.
- File infectors.
- Macro viruses.
These viruses may:
- Append malicious code to executable files.
- Create temporary files during infection.
- Generate logs.
- Store replication information.
Common file types include:
- EXE
- DLL
- COM
- BAT
- VBS
Forensic artefacts:
- Modified file hashes.
- Altered timestamps.
- Newly created executables.
- Antivirus quarantine records.
2. Worms
Worms spread automatically between systems.
Examples:
- Conficker
- Morris Worm
Worms often create:
- Copies of themselves.
- Network scanning logs.
- Configuration files.
- Autorun files.
- Temporary propagation files.
Typical locations:
- Windows Temp folders.
- User AppData directories.
- System folders.
- Removable media.
3. Remote Access Trojans (RATs)
RATs create numerous files to maintain persistence and support remote control.
Examples:
- DarkComet
- njRAT
- Quasar RAT
Files created may include:
- Configuration files.
- Persistence executables.
- Keylogging logs.
- Screenshot images.
- Captured credentials.
- Plugin modules.
Common locations:
C:\Users\<user>\AppData\Roaming
C:\ProgramData
%TEMP%
Mobile RATs may create:
- Recorded audio files.
- Screenshot files.
- Contact databases.
- Location logs.
4. Ransomware
Ransomware commonly creates:
- Encrypted versions of files.
- Ransom notes.
- Encryption logs.
- Key files.
- Victim identifiers.
Examples:
- WannaCry
- LockBit
Typical ransom note files:
- README.txt
- RECOVER_FILES.html
- HOW_TO_DECRYPT.txt
Forensic indicators include:
- Mass file creation events.
- Rapid timestamp changes.
- New file extensions.
- Large numbers of deleted originals.
5. Spyware
Spyware often creates hidden storage files.
These may contain:
- Browsing history.
- Keystrokes.
- Screenshots.
- Clipboard data.
- Credentials.
- Examples:
- Log files.
- SQLite databases.
- Text files.
- Encrypted archives.
6. Information Stealers
Modern credential stealers commonly generate:
- Browser credential databases.
- Stolen cookie archives.
- Cryptocurrency wallet copies.
- Screen captures.
- Data archives.
Examples:
- RedLine.
- Vidar.
- Raccoon Stealer.
The stolen information is frequently compressed into:
- ZIP
- RAR
- 7Z
archives before exfiltration.
Malware File Creation on Windows
Windows malware frequently uses:
%TEMP%
%APPDATA%
%LOCALAPPDATA%
C:\ProgramData
Startup folders
Scheduled task locations
Registry persistence may point to newly created files:
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Investigators examine:
- Prefetch files.
- USN Journal.
- Master File Table.
- Event logs.
- Amcache.
- Shimcache.
Malware File Creation on Android
Android malware may create files within:
- /data/data/
- /sdcard/
- /Android/data/
Common artefacts include:
- Configuration files.
- Databases.
- Downloaded payloads.
- Audio recordings.
- Images.
- Cached data.
Malicious applications often store information within:
- SQLite databases.
- XML preference files.
- Cache directories.
Malware File Creation on iOS
Although iOS has stronger application sandboxing, malicious applications can still create files.
Examples:
- Application databases.
- Temporary caches.
- Downloaded payloads.
- Configuration files.
Jailbroken devices present additional risks because malware can access larger portions of the filesystem.
Typical locations include:
/private/var/mobile/
/tmp/
/Library/Caches/
Persistence Through File Creation
Malware often creates files specifically to survive reboots.
Examples include:
- Startup Files
- Startup folders
- Launch agents
- Launch daemons
- Scheduled tasks
- Configuration Files
Contain:
- Server addresses.
- Encryption keys.
- User identifiers.
- Campaign IDs.
Service Files
Malware may install itself as:
- Windows services.
- Android background services.
- macOS launch daemons.
Anti-Forensic File Creation
Some malware creates files to hinder investigations.
Examples:
- Log wiping utilities.
- Timestamp manipulation tools.
- Decoy files.
- False documents.
- Secure deletion utilities.
Malware may also:
- Hide files.
- Encrypt files.
- Use alternate data streams.
- Employ fileless techniques.
Digital Forensic Examination
Investigators typically perform Timeline Analysis
Creation timestamps establish:
- Infection time.
- Execution periods.
- User activity.
File Hashing
Hashes determine:
- Known malware families.
- File integrity.
- Modified files.
Metadata Analysis
Examiners review:
- Creation times.
- Modification times.
- Access times.
- Ownership.
- Permissions.
Recovery of Deleted Files
Deleted malware files may still exist within:
- Unallocated space.
- Volume shadow copies.
- File system journals.
- Mobile flash storage remnants.
Challenges for Investigators
Several factors complicate investigations:
- Encryption.
- Fileless malware.
- Secure deletion.
- Cloud synchronization.
- Ephemeral mobile storage.
- Anti-forensic techniques.
- Automatic cleanup mechanisms.
Modern malware increasingly operates entirely in memory, reducing the number of persistent files left on a system.
Evidential Value
Created files can establish:
- Malware presence.
- Execution chronology.
- User interaction.
- Persistence mechanisms.
- Data theft activity.
- Attribution evidence.
- Scope of compromise.
Correlating created files with logs, registry artefacts, application data, and network evidence allows investigators to reconstruct the full attack timeline.
Conclusion
Viruses and other malicious software frequently create files on both computers and mobile devices to facilitate persistence, data theft, remote control, encryption, and communication. These files represent some of the most important artefacts available to digital forensic investigators.
The identification, recovery, and analysis of maliciously created files provide evidence of compromise, reveal attacker behaviour, and help reconstruct events during an investigation.
Although modern malware increasingly adopts memory-resident and fileless techniques, file creation remains a critical source of forensic evidence across Windows, Linux, macOS, Android, and iOS platforms.
About Athena Forensics
For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.
We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.
Our team are all security cleared and we offer non-disclosure agreements if required.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
