# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# Assassin v1.2 Users Guide

1 March, 2012

- 1
- 2
…
- 59
- 60
- 61
- 62
- 63
…
- 187
- 188

SECRET//ORCON//NOFORN
2.1 Installing Assassin
The Service Installers and Extractor follow the following steps to achieve soft
persistence for the Implant Service DLL:
1) Deploy Implant Service DLL
The Implant Service DLL is dropped to the target disk with a user-defined
name and location. If running the Extractor, it will select the bit-appropriate
DLL.
2) Install Service DLL
The Installer persists the Implant by registering the service DLL as a service
through direct registry modification. The Implant Service DLL is setup as a
member of the netsvcs svchost with a user-provided cover name and
description.
3) Cleanup and Exit
The Installer or Extractor is no longer needed and self deletes.
61
SECRET//ORCON//NOFORN

- 1
- 2
…
- 59
- 60
- 61
- 62
- 63
…
- 187
- 188