# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# Assassin v1.2 Users Guide

1 March, 2012

- 1
- 2
…
- 68
- 69
- 70
- 71
- 72
…
- 187
- 188

SECRET//ORCON//NOFORN
3.3 Implant Commands
The Implant commands are used to modify the configuration of the Assassin
Implant. The Implant configuration determines the behavior of the Implant once
it is running on the target machine.
beacon [initial=0] [default_int=0] [max_int=0] [factor=0.0] [jitter=0]
Set one or more of the beacon parameters.
initial
Initial wait after Implant startup before beacon (default = 0)
default_int
Default interval between beacons (default = 0)
max_int
Maximum interval between beacons (default = 0)
factor
Backoff factor to modify beacon interval (default = 0)
If beacon fails, multiply beacon interval by factor.
If beacon succeeds, restore beacon interval to default.
jitter
Range to vary the timing of beacons (default = 0)
blacklist [programs=[]] [files=[]]
Set the target blacklist. If no parameters are provided, the command will enter
a subshell; see section Appendix I:4.2 on Program List subshells.
programs
Set of executable names to include in the blacklist, specified as
a Python list or tuple
files
Set of blacklist files, specified as a Python list or tuple
Blacklist files are whitespace-delimited lists of executable
names to include in a target blacklist.
chunk_size <size>
Set chunk size to restrict network traffic per beacon. The Implant will chunk
files to size bytes and attempt to limit uploads to size bytes.
size
Maximum Implant upload size per beacon
Setting the size to 0 will disable upload chunking.
crypto_key
Generate a new cryptographic key for secure storage and communication.
hibernate <seconds>
Set the hibernate time in seconds after first execution. The Implant will lie
dormant until the hibernate period has elapsed.
seconds
Number of seconds to hibernate after first execution
id <parent> [child=None]
Set the Implant ID.
parent
Parent ID for implant, specified by 4 case-sensitive alpha-
numeric characters
70
SECRET//ORCON//NOFORN

- 1
- 2
…
- 68
- 69
- 70
- 71
- 72
…
- 187
- 188