Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//ORCON//NOFORN
7.5.4 Chunking
Assassin’s chunking feature allows operators to set limits on the amount of data
that is uploaded from the target to the listening post during any beacon
transaction. If the Implant is configured with a non-zero chunk size, it will send
files from the upload queue until this threshold is met or the queue is empty. The
Implant will always send the first file in the queue, regardless of size.
Subsequent files are checked for size and are only sent if they will not push the
beacon transaction past its upload limit.
Any task results or pushed files (from the output directory) that are larger than
the current chunk size parameter are broken up to conform to the current upload
limits. These chunks are later reassembled by the Post Processor.
Assassin sets a hard limit on the size of files that it uploads at 1 GiB. Any files
larger than the limit will be chunked no larger than 1 GiB. This size limit only
affects the way files are handled on target, not the upload limit set by the chunk
size configuration.
If the operator modifies the chunk size configuration, chunked files in the upload
queue are not reprocessed.
41
SECRET//ORCON//NOFORN