Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//ORCON//NOFORN
3.2 Behavior
The Cricket installer executes the following steps after gaining execution.
1) Load persistence module
Cricket loads the built-in persistence module in memory. The module is
initialized using the user-defined configuration.
2) Run persistence module
Cricket runs the persistence module against the built-in payload. The module
is responsible for the deployment and execution of the payload.
3) Cleanup and Exit
Cricket cleans up after its activity and exits. The Cricket EXE cleans itself up
by initiating a self delete before exiting; the DLL is run from memory and
does not need to self-delete.
29
SECRET//ORCON//NOFORN