Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//ORCON//NOFORN
5 Receipt XML Format
Bermuda's configuration is recorded in the Grasshopper receipt at build time under
build.xml. An example and description of the xml format is provided below.
5.1 XML Example
<PersistModule>
<UUID>9d03da02ab3a47d7bd28c9a776ba9806</UUID>
<SchTaskExe>
<TaskName>Cover Name</TaskName>
<TaskDescription>This is a description.</TaskDescription>
<TaskExePath>C:\Target\stub.exe</TaskExePath>
<PayloadDllPath>C:\Target\payload.dll</PayloadDllPath>
<MaxRunTime>infinite</MaxRunTime>
<TriggerType>at_logon</TriggerType>
<BeginDate>2012-06-21</BeginDate>
<EndDate />
<StartTime>00:00</StartTime>
<Duration>30m</Duration>
<Interval>5m</Interval>
<KillAtEnd />
<StartNow />
</SchTaskExe>
</PersistModule>
5.2 Field Definitions
UUID
The universally unique identifier for the module variant used in the build.
SchTaskExe
The scheduled task configuration information used by the Bermuda module.
TaskName
The overt name of the Windows scheduled task created by the module. The
name must conform to Windows NT file-naming conventions and cannot include
back slashes.
TaskDescription
The overt description of the Windows scheduled task created by the module.
TaskExePath
The path to the executable on the target run by the scheduled task. If the
payload is an EXE, it is the path to the payload. If the payload is a DLL, it is the
path to the Bermuda stub executable.
6
SECRET//ORCON//NOFORN