# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-Module-NetMan-v1_0-UserGuide

1 June, 2012

- 1
- 2
- 3
- 4
- 5
- 6

SECRET//ORCON//NOFORN
If the stub is unable to locate or start the payload or if the payload disappears, it will
uninstall. During uninstallation, Netman will delete the payload, remove the registry
entry, and self delete the stub.
The EXE or DLL payload is responsible for deleting itself from the target to trigger
uninstallation.
3.2 GH1
If the payload implements the GH1 interface, Netman embeds the payload as a
resource in the stub. Upon injection, the stub will load the payload DLL in memory.
The stub will uninstall the payload on demand or failure to start the payload. During
uninstallation, Netman will remove the registry entry and self delete the stub and
payload.
4 Footprint
Netman writes unobfuscated binaries to the target filesystem. The Netman Startup
stub is written to the filesystem at a user-specified path. If the payload is an EXE or
DLL, it is written to the filesystem at a user-specified path. If the payload
implements GH1, the payload is embedded as a resource in the Netman stub.
If the payload is an EXE, the process of the payload executable is visible in the Task
Manager during execution.
Netman will create a registry key in
HKLM\ SYSTEM\CurrentControlSet\Control\Network\
LightweightCallHandlers\NETMAN\Startup storing the path to the Netman Stub DLL.
5 Receipt XML Format
Netman's configuration is recorded in the Grasshopper receipt at build time under
build.xml. An example and description of the xml format is provided below.
5.1 XML Example
<PersistModule>
<UUID>9d03da02ab3a47d7bd28c9a776ba9806</UUID>
<Netman>
<StartupName>Cover Name</StartupName>
<StartupDllPath>C:\Test\stub.dll</StartupDllPath>
<PayloadPath>C:\Test\payload.dll</PayloadPath>
<StartNow />
</Netman>
</PersistModule>
5.2 Field Definitions
UUID
The universally unique identifier for the module variant used in the build.
Netman
The Netman configuration information used by the Netman module.
4
SECRET//ORCON//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6