Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//ORCON//NOFORN
3 Assassin Metadata XML Formats
All Assassin files uploaded to the LP contain metadata information. The metadata
contains information about both the target uploading the data and the file that was
sent. This section will explain the formatting for the metadata XML block. The
metadata XML block will be the first information contained in the XML data for all
result and push files.
XML Example
<Metadata version="1.0">
<ID>assn2Rlv</ID>
<MetadataSize>102</MetadataSize>
<FileSize>1596</FileSize>
<InputTime>2011-12-12T18:26:26</InputTime>
<FileName>c:\temp\output\eQX4BrOEtBJ.9JUaU1</FileName>
<FromImplant />
</Metadata>
Attribute Definitions
version
The version attribute specifies the version of the metadata data format.
Field Definitions
ID
The ID field contains the target ID of the target uploading the file. It will consist
of eight character string that consists of both the parent and child ids.
In the example above, the ID provided by the target is “assn2Rlv”, which means
the target has a parent ID of “assn.” and a child ID of “2Rlv”.
MetadataSize
The metadata size is the size of the metadata that was provided in the uploaded
file.
In the example above, the metadata size provided by the target is 102 bytes.
FileSize
The FileSize field provided the size of the file that was uploaded to the LP.
In the example above, the size of the uploaded data file was 1596 bytes.
ImputTime
The InputTime field provided the time and data on the target system that the file
was uploaded to the LP.
In the example above, the input time was set to: “2011-12-12T18:26:26”, aka
December 12
th
, 2011 at 6:26:26 PM.
FileName
139
SECRET//ORCON//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh