EFI partition, BIOS, other nonvolatile system memory? If it gets root level access it can hide anywhere there are a few KB. Even less than that will do if you're just putting a hook to instruct the computer to re-download the virus if it is detected that it has been removed.