# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# Assassin v1.3 Users Guide

11 June, 2013

- 1
- 2
…
- 48
- 49
- 50
- 51
- 52
…
- 191
- 192

SECRET//ORCON//NOFORN
7.7.1 Configuration Sets
The Implant identifies and manipulates three full sets of configurations: running,
persistent, and factory. Details about these configuration sets are herein
described.
Running
The running configuration is the settings the Implant is currently using to
operate. The running configuration is stored solely in memory and is lost
whenever the Implant restarts.
During operation, all modifications to the Implant configuration are made to the
running configuration. If changes are not explicitly persisted, they will be lost on
restart.
Persistent
The persistent configuration is the settings that the Assassin Implant will revert
to upon startup, regardless of the running configuration from the previous
session.
If the Implant Executable is able to access its original binary, the persistent
configuration is stored as a patch in the binary. If not, the persistent
configuration is saved to a file in the Implant’s startup directory with a random
filename and extension.
Factory
The factory configuration is the settings that the Implant had when it was built
and originally deployed. The operator may easily revert to this configuration at
any time.
The persistent configuration is stored as a patch in the Implant Executable
binary and is never modified.
50
SECRET//ORCON//NOFORN

- 1
- 2
…
- 48
- 49
- 50
- 51
- 52
…
- 191
- 192