# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-ServiceDLL-v1_3-UserGuide

- 1
- 2
- 3
- 4
- 5
- 6

SECRET//NOFORN
obfuscated copy of payload. Stub D uses a payload file name identical to
service dll filename except with a api.{exe|dll} suffix and extension. There is
no CRT because internally tinylibC is used to provide crt functionality. Stub
D does not support memory loading of NOD-persist dlls.
5. Stub E stub uses alternate resource ids, and uses the SC command to remove
service entries vs. using registry manipulation in standard stub, additionally it
does not use grasshopper common code. It stores the configuration data as
an obfuscated resource(using rc4 with random key). The payload is written
directly to disk from the grasshopper module so, stub does not contain an
obfuscated copy of payload. Stub E uses a payload file name identical to
service dll filename except with a lib.{exe|dll} suffix and extension. There is
a CRT dependency for stub E. Stub E does not support memory loading of
NOD-persist dlls.
6. Stub F stub uses alternate resource ids, and uses the uses registry
manipulation to remove service, additionally it does not use grasshopper
common code. It stores the configuration data as an obfuscated
resource(rolling xor with random key The payload is written directly to disk
from the grasshopper module so, stub does not contain an obfuscated copy
of payload. Stub F uses a payload file name identical to service dll filename
except with a res.{exe|dll} suffix and extension. There is no CRT dependency
for stub F. Stub F does not support memory loading of NOD-persist dlls.
2.4 Uninstall Procedure
Manual
The manual uninstall procedure consists of the following steps:
1. Stop the service, if it is running.
sc stop <SERVICE_NAME>
2. Delete the service from the Service Control Manager.
sc delete <SERVICE_NAME>
3. Reboot the target.
4. Delete the stub and payload executables from the filesystem.
del /F <SERVICE_PATH> <PAYLOAD_PATH>
Autonomous
The autonomous uninstall procedure consists of the following steps:
1. Delete the payload from the files system while the stub is running.
When the stub detects that the payload has been deleted, it will execute the
autonomous uninstall. The stub checks for the payload every 5 seconds. The
autonomous uninstall will perform the following steps:
1. Remove the service from the Windows registry.
2. Delete itself from the filesystem.
Kill File
The kill file uninstall procedure consists of the following steps:
4
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6