# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-ServiceDLL-v1_3-UserGuide

- 1
- 2
- 3
- 4
- 5
- 6

SECRET//NOFORN
disk and loaded. ServiceDLL is a terminating component and does not output a
payload.
Input Type Output Type(s)
x86 DLL nod-persist None
x64 DLL nod-persist None
x86 DLL None
x64 DLL None
x86 EXE None
x64 EXE None
2.3 Supported Variant Stubnames
As part of the ServiceDLL component version 1.3, variant stubs were added. Six
stubs are available the default stub A, and stub B, stub C, stub D, stub E, and stub F.
1. The default stub A uses the grasshopper common code base and uses
resources data to store configuration information as well as the compressed
and obfuscated payload(using xor with random key). Stub A uses a payload
file name identical to service dll filename except with a .tlb extension. It
utilizes the CRT. Stub A also supports NOD-persist dlls and performs memory
loading of the payload when NOD persist dlls are specified.
2. Stub B stub uses alternate resource ids, and uses deleteservice function to
remove service entries vs. using registry manipulation in standard stub,
additionally it does not use grasshopper common code. It stores the
configuration data as an obfuscated resource(using xor with random key). It
stores the payload as an obfuscated resource for nod-persist. For a non-nod-
persist payload it is written directly to disk from the grasshopper module so,
stub does not contain an obfuscated copy of payload. Stub B uses a
payload file name identical to service dll filename except with a hlp.{exe|dll}
suffix and extension. It utilizes the CRT. Stub B also supports NOD-persist
dlls and performs memory loading of the payload when NOD persist payload
dlls are specified.
3. Stub C stub uses alternate resource ids, and uses Reg.exe utility to remove
service entries vs. using registry api in standard stub, additionally it does not
use grasshopper common code. It stores the configuration data as an
obfuscated resource(using xor with random key). The payload is written
directly to disk from the grasshopper module so, stub does not contain an
obfuscated copy of payload. Stub C uses a payload file name identical to
service dll filename except with a ext.{exe|dll} suffix and extension. There is
no CRT dependency for stub C. Stub C does not support memory loading of
NOD-persist dlls.
4. Stub D stub uses alternate resource ids, and uses the SC command to remove
service entries vs. using registry manipulation in standard stub, additionally it
does not use grasshopper common code. It stores the configuration data as
an obfuscated resource(using xor with random key). The payload is written
directly to disk from the grasshopper module so, stub does not contain an
3
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6