# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# Grasshopper-v1_1-AdminGuide

1 December, 2013

- 1
- 2
…
- 9
- 10
- 11
- 12
- 13
…
- 106
- 107

SECRET//ORCON//NOFORN
rule that will be applied by default whenever the payload is executed. The
Override Rule tags define a series of optional overrides based on the persistence
module that is included in the rule. At build time, if a Persistence module with a
UUID that matches one of the override rules, that rule will be applied instead of
the default.
In the example above, the default rule is set to “asn.rule”, and there are three
override rules that change the rule to “..\..\Rules\true.rule”.
Settings
The Settings tag is only used in Persistence Modules and it defines information
that is provided to the Persistence Module binary. The child tags are all arbitrary
and completely optional.
In the example above, the Settings tag has a child tag of “RunMode”, which is
specific to the Grasshopper 1.0 persistence modules and it tells the module if the
payload will be dropped to disk or loaded directly into memory.
Stub
The Stub tag contains the file path, relative or complete, to the stub file for the
persistence module and a type definition which defines a series of arbitrary file
description values. The field only exists in Persistence Module entries and is
optional. The stub file is executed on the target device, and is responsible for
executing the payload and maintaining persistence, if applicable.
In the example above, the StubLocal File Path tag is set to “Stub-ServiceExe-
Memory-GH1-32.exe” and the Stub Type flag describes the file as being a 32-bit
executable file.
Supported Types
The Supported Types tag contains all of the type combinations that are
supported by the Persistence Module. The tag is required and must contain at
least one child entry. For a more detailed description of the child entries, see the
Type tag description below.
In the example above, the Persistence Module only supports one type:
•
<Type format="dll" bitness="32" run_level="system"/>
Type
The Type tag is used differently in Payload and Persistence Module entries. In
Payload entries, the type tag provides details about the payload binary that
grasshopper uses to determine compatibility with the provided persistence
modules. The Persistence Module entry will contain one or more type
specifications within the Supported Types flag. This allows a persistence module
to support more than one type description without requiring multiple catalog
entries. The attributes of the Type field are completely arbitrary, and not
dependent on order, but must match in order to apply a persistence module to a
payload module.
In the examples above, the Payload module has a type field defining
“bitness=32 format=exe run_level=system”. This tells Grasshopper that the
11
SECRET//ORCON//NOFORN

- 1
- 2
…
- 9
- 10
- 11
- 12
- 13
…
- 106
- 107