# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

## Documents

## Analysis

### Imperial

- Achilles -- User Guide
  15 July, 2011
- SeaPea -- User Guide
- Aeris -- Users Guide

### UCL / Raytheon

- (S//NF) CSIT 15083 -- HTTPBrowser
  11 September, 2015
- (S//NF) CSIT 15085 -- NfLog
  11 September, 2015
- (S//NF) Symantec -- Regin - Stealthy Surveillance
  11 September, 2015
- (S//NF) FireEye -- HammerToss - Stealthy Tactics
  11 September, 2015
- (S//NF) VB -- Gamker
  11 September, 2015
- (S//NF) SentinelOne - Rombertik
  4 September, 2015
- (S//NF) FireEye - Window into Russian Cyber Ops
  4 September, 2015
- (S//NF) MalwareBytes -- HanJuan Drops New Tinba
  4 September, 2015
- (S//NF) Cisco -- Rombertik
  4 September, 2015
- (S//NF) RSA -- Terracotta VPN
  4 September, 2015
- (S//NF) Dell SecureWorks -- Sakula
  28 August, 2015
- (S//NF) CSIT 15078 -- Skipper Implant
  28 August, 2015
- (S//NF) Symantec -- Evolution of Ransomware
  28 August, 2015
- (S//NF) CSIT 15079 -- Cozy Bear
  28 August, 2015
- (U) McAfee DLL Hijack -- PoC Report
  28 August, 2015
- (U) HeapDestroy - DLL Rootkit -- PoC Report
  28 August, 2015
- (S//NF) TW -- WildNeutron
  21 August, 2015
- (S//NF) NMehta -- Theories on Persistence
  21 August, 2015
- (S//NF) CERT-EU -- Kerberos Golden Ticket
  21 August, 2015
- (S//NF) VB Dridex 2015 -- Dridex
  21 August, 2015
- (S//NF) Symantec -- Black Vine
  14 August, 2015
- (S//NF) CSIR 15005 -- Stalker Panda
  14 August, 2015
- (S//NF) CSIT 15016 -- Elirks RAT
  14 August, 2015
- (S//NF) Eset -- Liberpy
  14 August, 2015
- (S//NF) Eset -- Potao
  14 August, 2015
- (U) Sinowal Web Form Scraping -- PoC Report
  7 August, 2015
- (S//NF) MIRcon -- Something About WMI
  7 August, 2015
- (U) PoC Report -- Anti-Debugging and Anti-Emulation
  7 August, 2015
- (S//NF) SY 2015 -- Butterfly Attackers
  7 August, 2015
- (S//NF) Symantec -- ZeroAccess Indepth
  7 August, 2015
- (S//NF) CI 2015 -- PlugX 7.0
  7 August, 2015
- (U) Mimikatz Password Scanning Analysis -- PoC Report
  7 August, 2015
- (S//NF) TrendMicro -- Understanding WMI Malware
  7 August, 2015
- (S//NF) CanSecWest 2013 -- DEP/ASLR Bypass Without ROP/JIT
  4 August, 2015
- (U) Software Restriction Policy: A/V Disable -- PoC Report
  26 June, 2015
- (U) WMI Persistence Proof of Concept -- Supplemental Report
  26 June, 2015
- (U) Mimikatz PoC Report
  29 May, 2015
- (U) Pony / Fareit PoC Report
  29 May, 2015
- (U) SIRIUS Pique Proof-of-Concept Delivery -- User-Mode DKOM -- Final PoC Report
  26 January, 2015
- (U) SIRIUS Pique Proof-of-Concept Delivery -- Direct Kernel Object Manipulation (DKOM) -- Interim PoC Report
  29 December, 2014
- (U) Direct Kernel Object Manipulasiton (DKOM) -- Proof-of-Concept (PoC) Outline
  21 November, 2014

### Highrise

- HighRise 2.0 Users Guide
  16 December, 2013

### BothanSpy

- BothanSpy 1.0
  20 March, 2015
- Gyrfalcon 2.0 User Guide
  26 November, 2013
- Gyrfalcon 1.0 User Manual
  28 January, 2013

### OutlawCountry

- OutlawCountry v1.0 User Manual
  4 June, 2015
- OutlawCountry v1.0 Test Plan

### Elsa

- ELSA User Manual
  27 September, 2013

### Brutal Kangaroo

- Brutal Kangaroo -- Drifting Deadline v1.2 - User Guide
  23 February, 2016
- EzCheese v6.3 - User Guide
  18 July, 2013
- EzCheese v6.2 - User Guide (Rev. B)
  18 July, 2013
- EzCheese v6.2 - User Guide (Rev. A)
  12 April, 2013
- EZCheese v6.2 - IVV TDR Slides
  17 July, 2013
- Emotional Simian v2.3 - User Guide
  30 August, 2013
- Emotional Simian v2.2 - User Guide (Rev. A)
  13 August, 2013
- Emotional Simian v2.1 - User Guide
  15 April, 2013
- Emotional Simian v2.1 - TDR
- Emotional Simian v2.0 - Tech Chief Brief
- Shadow v1.0 - User Guide
  31 August, 2012

### Cherry Blossom

- CherryBlossom -- System Req Spec (CDRL-10)
  8 August, 2012
- CherryBlossom -- Quick Start Guide
  19 July, 2012
- WiFi Devices
- CherryBlossom -- Installation Guide
  19 July, 2012
- CherryBlossom -- Operating Environment (S//NF)
- CherryBlossom -- Mobile VPN Server
  26 April, 2012
- CherryBlossom -- Mobile VPN Software - Installation and User Manual
  14 September, 2012
- CherryTree Documentation (EER)
- CherryBlossom -- README
  20 April, 2011
- CherryBlossom -- x86 Flytrap - Completion Review Briefing
  26 April, 2011
- CherryBlossom -- x86 Flytrap - Users Manual
  28 February, 2011
- CherryBlossom -- x86 Flytrap - Quick Start Guide
  25 February, 2011
- Flytrap -- Firmware Upgrade Procedures - DLink DIR130
- Flytrap -- Firmware Upgrade Procedures - Belkin F5D8231
- Flytrap - Firmware Upgrade Procedures - Linksys WRT320N
- Flytrap -- Firmware Upgrade Procedures - Linksys WRT54G
- Flytrap -- Firmware Upgrade Procedures - Linksys WRT300N
- Flytrap -- Firmware Upgrade Procedures - Linksys WRT54GL
- Flytrap -- Firmware Upgrade Procedures - Linksys WRT54GL
- Linksys WRT300N Upgrade Tests
  20 January, 2010
- Belkin F5D8231 Upgrade Tests
  20 January, 2010
- Flytrap -- Exploit Enhancements
  1 October, 2007
- Flytrap -- Exploit Enhancements (dev notes)
  1 December, 2007
- Flytrap -- Inventory (1)
- Flytrap -- Inventory (2)
- Sundew -- User Manual
  24 May, 2007
- Sundew -- Test Plan
- Sundew -- WPA Supplicant Config
- Sundew -- Win32 net connection tools
- Nightshade -- Users Manual
  1 November, 2007
- Survey List (1)
  19 November, 2004
- Survey list (2)
- Access Point Hardware
- Beacon Settings Checklist
- Netgear SNMP Survey Results
- Tools
- CherryBomb -- CherryBlossom FAT Procedures (CDRL-14a)
  8 August, 2012
- CherryBomb -- CherryBlossom FAT Procedures FIELD
  8 August, 2012
- CherryBomb -- CherryBlossom Test Plan (CDRL-13)
  8 August, 2012
- CherryBomb -- CherryBlossom - CherryTree Upgrade Test Procedures (CDRL-14b)
  8 August, 2012
- CherryBomb -- CherryBlossom RVT Matrix (CDRL-11)
  8 August, 2012
- CherryBomb -- CherryBlossom FAT V&V Report (CDRL-15a)
  19 July, 2012
- CherryBomb -- CherryBlossom Internal Test Procedures (CDRL-14c)
  21 June, 2012
- CherryBomb -- CherryBlossom Internal V&V Report (CDRL-15c)
  6 March, 2012
- CherryBomb -- CherryBlossom - CherryTree Upgrade V&V Report (CDRL-15b)
  6 March, 2012
- TestResults Field
  20 August, 2009
- CherryBomb_CherryBlossom_CherryTreeUpgrade_VAndVReport_CDRL-15b
- Proxy Unit Test Notes
- Flytrap-proxy-demo-script
- CherryBomb_CherryBlossom_FAT_VAndVReport_CDRL-15a
- TestProcedures
- Hacking - Image Notes
- CherryBomb_CherryBlossom_Internal_VAndVReport_CDRL-15c
- TestResults
- CherryBomb_CherryBlossom_FAT_Procedures_CDRL-14a
- Redirect Tests
- CherryBomb_CherryBlossom_Internal_TestProcedures_CDRL-14c
- SRI-SLO-FF-2012-177-CherryBlossom_UsersManual_CDRL-12_SLO-FF-2012-171
- CherryBomb_CherryBlossom_FAT_Procedures_FIELD

### Pandemic

- Pandemic 1.1 (S/NF)
  16 January, 2015
- Pandemic 1.1-RC1 (S/NF)
  17 April, 2014
- Pandemic 1.1-RC1 -- IVVRR Checklist
  16 January, 2015
- Pandemic 1.0 (S/NF)
  17 April, 2014
- Pandemic 1.0 -- IVVRR Checklist
  9 June, 2014

### Athena

- Athena v1.0 User Guide
  29 February, 2016
- Athena Technology Overview
- Athena (Design)
  22 September, 2015
- Athena (Demo)
  24 November, 2015
- Athena (Design/Engine)
- Athena (Developer Kick-Off)
- Athena (Infrastructure)

#### Other related documents

- Athena Progress (2016-02-26)
  26 February, 2016
- Athena Progress (2016-02-16)
  16 February, 2016
- Athena Progress (2016-02-10)
  10 February, 2016
- Athena Progress (2016-01-19)
  19 January, 2016
- Athena Progress (2016-01-19)
  19 January, 2016
- Athena Progress (2016-01-12)
  12 January, 2016
- Athena Progress (2016-01-12)
  12 January, 2016
- Athena Progress (2015-12-22)
  22 December, 2015
- Athena Progress (2015-12-15)
  15 December, 2015
- Athena Progress (2015-12-08)
  8 December, 2015
- Athena Progress (2015-12-01)
  1 December, 2015
- Athena Progress (2015-11-24)
  24 November, 2015
- Athena Progress (2015-11-17)
  17 November, 2015
- Athena Progress (2015-11-10)
  10 November, 2015
- Athena Progress (2015-11-03)
  3 November, 2015
- Athena Progress (2015-10-27)
  27 October, 2015
- Athena Progress (2015-10-20)
  20 October, 2015
- Athena Progress (2015-10-14)
  14 October, 2015
- Athena Progress (2015-10-05)
  5 October, 2015
- Athena Progress (2015-09-29)
  29 September, 2015
- Athena Progress (2015-09-22)
  22 September, 2015
- Athena Progress (2015-09-14)
  14 September, 2015
- Athena Progress (2015-09-01)
  1 September, 2015

### AfterMidnight

- AfterMidnight v1.0 Users Guide
  18 August, 2014
- AlphaGremlin v0.1.0 Users Guide
  1 June, 2014
- AfterMidnight Diagrams
- Assassin v1.4 Users Guide
  1 June, 2014
- Assassin v1.3 Users Guide
  11 June, 2013
- Assassin v1.3 Quick Start
  1 June, 2013
- Assassin v1.3 Training
- Assassin v1.3 Quicker Start
- Assassin v1.2 Quick Start
  1 October, 2012
- Assassin v1.2 Users Guide
  1 March, 2012
- Assassin v1.2 Training
- Assassin v1.2 Quicker Start
- Assassin v1.1 Users Guide
  1 March, 2012

### Archimedes

- Archimedes 1.0 User Guide
  18 December, 2012
- Archimedes 1.3 Addendum
  13 January, 2014
- Archimedes 1.2 Addendum
  23 August, 2013
- Archimedes 1.1 Addendum
  28 June, 2013
- Fulcrum User Manual v0.62
  5 December, 2011
- Fulcrum User Manual v0.61
  15 November, 2011
- Fulcrum Mission Manager Brief v0.6
  5 July, 2011
- Fulcrum SRS v0.6
  28 June, 2011
- Fulcrum PSP Testing Results

### Scribbles

- Scribbles v1.0 RC1 - User Guide
  1 March, 2016
- Scribbles (Source Code)
  1 March, 2016
- Scribbles v1.0 RC1 - IVVRR Checklist
  23 February, 2016
- Scribbles v1.0 RC1 - Readiness Review Worksheet
  23 February, 2016

### Weeping Angel

- Extending - User Guide
  28 February, 2014

### Hive

- Users Guide
  9 November, 2015
- Developers Guide
  15 October, 2014
- Developers Guide (Figures)
- Hive Beacon Infrastructure
- Hive Infrastructure Installation and Configuration Guide
  11 November, 2012
- Infrastructure Switchblade
  30 April, 2014

### Grasshopper

- Grasshopper-v1_1-AdminGuide
  1 December, 2013
- Grasshopper-v2_0_2-UserGuide
- StolenGoods-2_1-UserGuide
  14 July, 2014
- GH-Module-Null-v2_0-UserGuide
  1 December, 2013
- GH-Module-Buffalo-Bamboo-v1_0-UserGuide
  1 June, 2012
- GH-Module-Wheat-v1_0-UserGuide
  1 June, 2012
- GH-Module-Crab-v1_0-UserGuide
  1 June, 2012
- GH-Module-WUPS-v1_0-UserGuide
  1 June, 2012
- GH-Module-Scrub-v1_0-UserGuide
  1 June, 2012
- GH-Module-Bermuda-v1_0-UserGuide
  1 June, 2012
- GH-Module-NetMan-v1_0-UserGuide
  1 June, 2012
- GH-Run-v1_1-UserGuide
- GH-ServiceProxy-v1_1-UserGuide
- GH-ServiceDLL-v1_3-UserGuide
- GH-Drop-v1_0-UserGuide
- GH-ScheduledTask-v1_1-UserGuide
- IVVRR-Checklist-StolenGoods-2_0
  18 February, 2014
- StolenGoods-2_0-UserGuide
  14 January, 2014
- Grasshopper-v1_1-UserGuide
  1 December, 2013
- GH-Run-v1_0-UserGuide
- Grasshopper-v2_0-UserGuide
- GH-ServiceDLL-v1_0-UserGuide
- GH-ServiceDLL-v1_1-UserGuide
- GH-ServiceDLL-v1_2-UserGuide
- GH-ScheduledTask-v1_0-UserGuide
- Grasshopper-v2_0_1-UserGuide
- GH-ServiceProxy-v1_0-UserGuide

### Marble Framework

- Marble Framework (Source Code)

#### Other related documents

- Marble Filelist
  27 March, 2017

### Dark Matter

- Sonic Screwdriver
  29 November, 2012
- DerStarke v1.4
- DerStarke v1.4 RC1 - IVVRR Checklist
- DarkSeaSkies v1.0 - Test Plan Procedures
  26 January, 2009
- FDOS_1_0_FINAL_freedos_setup_odin_fips
  11 May, 1998
- Triton v1.3
- DarkSeaSkies v1.0 - URD
  26 January, 2009
- DarkSeaSkies v1.0 - CONOP
  26 January, 2009
- DarkSeaSkies v1.0 - TDR
  26 January, 2009
- DarkSeaSkies v1.0 - User Manual
  26 January, 2009
- NightSkies v1.2 - User Guide
  1 December, 2008
- SeaPea v2.0 - User Guide
  6 November, 2008

#### Other related documents

- FDOS v1.0 FINAL - B57 udiag