# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# Assassin v1.1 Users Guide

1 March, 2012

- 1
- 2
…
- 47
- 48
- 49
- 50
- 51
…
- 186
- 187

SECRET//ORCON//NOFORN
8 Crypto
The Assassin toolset uses a modified RC4 stream cipher to provide cryptographic
services. Any data stored on the target file system or sent over the wire is
encrypted prior to potential exposure.
The Implant carries a sixteen byte key that is generated and patched into the binary
by the Builder. A sixteen byte session key is generated by combining a four byte
nonce with the key and calculating the MD5 hash. A new session key is calculated
per crypto transaction.
The four byte nonce is prepended to the crypt text before being stored or
transmitted.
Assassin modifies the RC4 scheme by flushing the crypto state machine with 1024
zeroes during initialization.
49
SECRET//ORCON//NOFORN

- 1
- 2
…
- 47
- 48
- 49
- 50
- 51
…
- 186
- 187