# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# Assassin v1.1 Users Guide

1 March, 2012

- 1
- 2
…
- 129
- 130
- 131
- 132
- 133
…
- 186
- 187

SECRET//ORCON//NOFORN
received from the LP are stored. The output directory is where the task results
are stored. The startup directory is where all startup tasks are stored. The
staging directory is where all chunked result files are stored, awaiting transport
to the LP. The push directory is a special directory provided as a way to push
data files from any other source to the LP using the Assassin transport setup.
In the example above, the input directory is set to “c:\temp\input”, the output
directory is set to “c:\temp\output”, the startup directory is set to
“c:\temp\startup”, the staging directory is set to “c:\temp\staging” and the push
directory is set to “c:\temp\push”.
Max Consecutive Fails
In Assassin, the maximum consecutive failures are the number of consecutive
beacon attempts that have not resulted in a successful beacon. These failures
can be due to a blacklist / whitelist failure or a failed transport attempt. Once
this count is reached the Implant will uninstall.
In the example above, the maximum consecutive failures has been set to 10.
Transport List
The TransportList tag contains an ordered list of Transport tags defining the
members of the list.. The Assassin transports list size is limited to a compiled
size of 768 bytes.
Transport
The Transport tag specifies the configuration of one transport in the transport
list.
Attribute Definitions
type
The type attribute defines the type of transport being defined.
Assassin v1.1 supports HTTPS and WebDAV transports.
tries
The tries attribute specifies the number of times the transport will be
attempted for communication before failing over to the next configured
transport in the list.
Field Definitions
Host
The host tag specifies the domain name or IP address of the Collide
listening post or redirector to which the transport should send comms
traffic. This tag is used for both HTTPS and WebDAV transport types.
Port
The port tag defines the TCP port to which the transport should send
comms traffic. This tag is only used for HTTPS transport types.
131
SECRET//ORCON//NOFORN

- 1
- 2
…
- 129
- 130
- 131
- 132
- 133
…
- 186
- 187