# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-ServiceDLL-v1_2-UserGuide

- 1
- 2
- 3
- 4
- 5

SECRET//NOFORN
x86 DLL None
x64 DLL None
x86 EXE None
x64 EXE None
2.3 Supported Variant Stubnames
As part of the ServiceDLL component version 1.2, variant stubs were added. Three
stubs are available the default stub A, and stub B, and stub C.
1. The default stub A uses the grasshopper common code base and uses
resources data to store configuration information as well as the compressed
and obfuscated payload. Stub A uses a payload file name identical to service
dll filename except with a .tlb extension. It utilizes the CRT. Stub A also
supports NOD-persist dlls and performs memory loading of the payload when
NOD persist dlls are specified.
2. Stub B stub uses alternate resource ids, and uses deleteservice function to
remove service entries vs. using registry manipulation in standard stub,
additionally it does not use grasshopper common code. It stores the
configuration data as an obfuscated resource. It stores the payload as an
obfuscated resource. Stub B uses a payload file name identical to service dll
filename except with a hlp.{exe|dll} suffix and extension. It utilizes the CRT.
Stub B also supports NOD-persist dlls and performs memory loading of the
payload when NOD persist payload dlls are specified.
3. Stub C stub uses alternate resource ids and, uses Reg.exe utility to remove
service entries vs. using registry api in standard stub, additionally it does not
use grasshopper common code. It stores the configuration data as an
obfuscated resource. It stores the payload as an obfuscated resource. Stub
C uses a payload file name identical to service dll filename except with a ext.
{exe|dll} suffix and extension. There is no CRT dependency for stub C.
Stub C does not support memory loading of NOD-persist dlls.
2.4 Uninstall Procedure
Manual
The manual uninstall procedure consists of the following steps:
1. Stop the service, if it is running.
sc stop <SERVICE_NAME>
2. Delete the service from the Service Control Manager.
sc delete <SERVICE_NAME>
3. Reboot the target.
4. Delete the stub and payload executables from the filesystem.
del /F <SERVICE_PATH> <PAYLOAD_PATH>
Autonomous
The autonomous uninstall procedure consists of the following steps:
1. Delete the payload from the files ystem while the stub is running.
3
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5