# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# Grasshopper-v1_1-AdminGuide

1 December, 2013

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 106
- 107

SECRET//ORCON//NOFORN
1.3.1 XML Example
<Grasshopper version='1.0'>
<Catalog>
<Payload>
<Name>Assassin DLL-32</Name>
<Description>Assassin 1.1 32 dll, doesn't include persistence</Description>
<RuleData>
<DefaultRule>asn.rule</DefaultRule>
<OverrideRuleuuid='6578ece4a8634d88924fd8f223c3d3ec' name='buffalo-
32'>..\..\Rules\true.rule</OverrideRule>
<OverrideRuleuuid='05921fcde5194f668d5f4eb9d79a219b' name='bamboo-
32'>..\..\Rules\true.rule</OverrideRule>
<OverrideRuleuuid='f329431bf7e647a486ef497218c65a67' name='netman-
32'>..\..\Rules\true.rule</OverrideRule>
</RuleData>
<UUID>f00ca407f88649c88e7204d4d7bd4382</UUID>
<Type bitness="32" format="dll" run_level="system"/>
<Parameters prompt='no' />
<Obfuscate type='reorder'>
<MinBlockSize>50</MinBlockSize>
<MaxBlockSize>100</MaxBlockSize>
</Obfuscate></Payload>
<PersistenceModule>
<Name>Crab DLL-32 (GH1)</Name>
<Method>Standalone Service</Method>
<Description>Windows Service Executable</Description>
<Interface>gh1</Interface>
<Rule>crab.rule</Rule>
<Handler>crab.py</Handler>
<Binary32>..\common\PM-Registry-32.dll</Binary32>
<Binary64>..\common\PM-Registry-64.dll</Binary64>
<Stub>
<Type format=”exe” bitness=”32” />
<LocalFilePath>Stub-ServiceExe-Memory-GH1-32.exe</LocalFilePath>
</Stub>
<UUID>533eb9283e34414e8e1663d46af9d350</UUID>
<Settings>
<RunMode>memory</RunMode>
</Settings>
<SupportedTypes>
7
SECRET//ORCON//NOFORN

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 106
- 107