# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# Grasshopper-v1_1-AdminGuide

1 December, 2013

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 106
- 107

SECRET//ORCON//NOFORN
1.3.2 Field Definitions
Binary32
The Binary32 tag contains the file path, relative or complete, to the 32-bit binary
file for the persistence module. The file is executed on the target device, and is
responsible for setting up the persistence and executing the payload.
In the example above, the binary 32 tag is set to “..\common\PM-Registry-32.dll”.
Binary64
The Binary64 tag contains the file path, relative or complete, to the 64-bit binary
file for the persistence module. The file is executed on the target device, and is
responsible for setting up the persistence and executing the payload.
In the example above, the binary 32 tag is set to “..\common\PM-Registry-64.dll”.
Description
The Description field contains a details description of the module it’s contained
within, but it will only be displayed during a detailed print of the catalog or
applied modules.
In the examples above, the descriptions provided in the two modules are:
• Assassin 1.1. Injection Extractor, includes persistence
• Runs payload as on-disk exe
Handler
The Handler tag contains the file path, relative or complete, to the Python
handler file responsible for all persistence module specific processing. This only
exists in persistence modules and is required for the module to function properly.
For more information on class files, see the user manual section on persistence
module handlers.
Interface
The Interface tag describes the interface that the module has been built to use.
The interface defines the methods for how Grasshopper will load, deploy, and
uninstall the payload. An interface is required for all catalog modules. For more
information on interfaces see the user manual section on grasshopper interfaces.
In the examples above, the Interface fields provided in the example are both set
to ‘run_once’, defining that grasshopper will only run the payload on execution
and not provided any additional persistence.
Method
The method type tag describes the persistence method the module employs.
This field exists in both the payload and persist modules and is completely
informative and optional. It is not included in the final binary and has no effect
on the final build.
In the examples above, the methods described in the two modules are:
9
SECRET//ORCON//NOFORN

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 106
- 107