WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 19
- 20
- 21
- 22
- 23
…
- 30
- 31

SECRET//NOFORN
(U) Hive 2.9.1 User's Guide (U) Post-Deployment
4 (U) Post-Deployment
4.1 (S) Self-Delete
(S) Self-delete was first added to Hive in version 2.2 and is used to ensure that any Hive implant
that lays dormant (has not beaconed successfully to its designated LP or has not been triggered
from a command post) for a predetermined amount of time effectively destroys itself with the only
remnant being a “configuration file” (.config) and a log file (.log) left behind in /var directory. During
normal operation the .config file is empty, with its last modified time indicating the time of last
contact – either from a beacon or a trigger – and the .log file is non-existent. When self-delete
executes, the Hive binary is deleted from the host and the .log file is created with a time stamp
inserted into it using the format yymmddHHMMSS. (The time stamp inserted into the file should
match the last modification time of the file.) On Linux and MikroTik, the implant will overwrite the
binary on the filesystem with zeros.
(S) The decision to self-delete is determined by the difference between the system time and the
last-modified time stamp on the configuration file. Whenever the system time exceeds the time
stamp on the configuration file by more than the delete delay, Hive will self-delete. It is important to
note that the system time on implanted devices may vary widely depending upon the environment.
Consequently, the simple act of correcting the date/time on the device by a system administrator
could result in self-deletion.
(S) Self-deletion may also occur if the .config file cannot be written to the /var (or otherwise
specified) directory. This can occur on devices where the filesystem path is in flash or other read-
only memory.
SECRET//NOFORN//20401109 17

- 1
- 2
…
- 19
- 20
- 21
- 22
- 23
…
- 30
- 31