# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# Grasshopper-v1_1-UserGuide

1 December, 2013

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 52
- 53

SECRET//ORCON//NOFORN
1.2.1 Installers
Installers are executables responsible for loading and executing persistence
modules. Once a payload has been installed using one of these modules, the
Installer removes itself from the target.
Installer executables may be built as .EXE's or .DLL's in 32- or 64-bit. Produced
DLLs confirm to both F&F version 2 and ICE version 3. The executables are
configured using an Installer-specific builder. Configured payloads and
persistence modules are obfuscated and packed as resources in the installer
executable.
Grasshopper
The Grasshopper Installer evaluates the conditions on a target machine to
select an appropriate persistence module from an assortment of modules
before using it to install an appropriate payload. Selection of persistence
module and payload is based on rules specified by the operator at build time.
Grasshopper may be configured to generate a log file that records its activity,
including any data it collected and the return codes of each persistence
module it executed.
Cricket
The Cricket Installer uses a given persistence module to install a given
payload. The operator is responsible for selecting the appropriate module
and payload for the target.
7
SECRET//ORCON//NOFORN

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 52
- 53