# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# AfterMidnight v1.0 Users Guide

18 August, 2014

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 67
- 68

SECRET//NOFORN
1.4 Architecture
AM consists of a number of different layers, each memory-loaded by the layer prior.
In this way only a minimum of functionality is in the clear on disk. When loading,
AM performs the following:
1. Service DLL is loaded. This DLL is all cleartext and is made to look as
innocuous as possible.
2. Service DLL finds Midnight Core (or just “Core”) on disk, reads it in to
memory, deobfuscates it, and loads it. Core contains all
encryption/decryption and network communicators for AM
3. Core downloads its plan, any needed gremlins, and the LP key, storing them
on disk encrypted with the LP key. Note that the LP key is never written to
disk in any form.
4. Core memory-loads the Master Gremlin and runs the plan
5. Gremlins will be loaded as-needed according to the plan
13
SECRET//NOFORN
Service DLL
On Disk
Unencrypted/Unobfusc
ated
No Networking
AfterMidnight
Core
On Disk, Obfuscated
Master Gremlin
Downloaded just in
time
Encrypted
Other Gremlins
Downloaded just in
time
Encrypted
Memory
Memory
Memory
HTTPS
Octopus
Apache HTTPs
Server
Encrypted
Gremlins

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 67
- 68