# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-Module-Crab-v1_0-UserGuide

1 June, 2012

- 1
- 2
- 3
- 4
- 5
- 6

SECRET//ORCON//NOFORN
If the stub is unable to locate or start the payload or if the payload disappears, it will
uninstall. During uninstallation, Crab will delete the payload, remove the service,
and self delete the stub.
The EXE or DLL payload is responsible for deleting itself from the target to trigger
uninstallation.
3.2 GH1
If the payload implements the GH1 interface, Crab embeds the payload as a
resource in the stub and configures the stub with the name of the service that
identifies it. Upon execution, the stub will load the payload DLL in memory.
The stub will uninstall itself on demand or failure to start the payload. During
uninstallation, Crab will remove the service and self delete the stub and payload.
4 Footprint
Crab writes unobfuscated binaries to the target filesystem. The service executable
stub is written to the filesystem at a user-specified path. If the payload is an EXE or
DLL, it is written to the filesystem at a user-specified path. If the payload
implements GH1, the payload is embedded as a resource in the Crab stub.
The processes of the service executable stub and payload EXE are visible in the Task
Manager during execution.
Crab will create a service visible in the Services view of the Microsoft Management
Console with the user-specified display name and description.
A registry key will be placed in
HKLM\SYSTEM\CurrentControlSet\services\<ServiceName>
holding the description and the path to the service stub.
5 Receipt XML Format
Crab's configuration is recorded in the Grasshopper receipt at build time under
build.xml. An example and description of the xml format is provided below.
5.1 XML Example
<PersistModule>
<UUID>9d03da02ab3a47d7bd28c9a776ba9806</UUID>
<ServiceExe>
<ServiceName>Cover Name</ServiceName>
<ServiceExePath>C:\Target\stub.exe</ServiceExePath>
<PayloadPath>C:\Target\payload.dll</PayloadPath>
<DisplayName>Cover Name</DisplayName>
<Description>This is a description.</Description>
</ServiceExe>
</PersistModule>
4
SECRET//ORCON//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6