Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//ORCON//NOFORN
The chunk size field sets the maximum file size that will be uploaded to
the LP at a time. Any file that is larger than the chunk size will be broken
up into multiple parts, and then reassembled at the post processing step.
In the example above, the chunk size value is set to one mebibyte.
Transport List
The transport list field contains all of the transport settings for the target
Implant. For a more detailed definition of the transport list field see the
Assassin Receipt file description of the transport list field.
Status Result List
The status result list field is a custom status result that provides both the target
implant’s blacklist and whitelists.
XML Example
<StatusResultList>
<Blacklist>
<Prog>avira.exe</Prog>
<Prog>avg.exe</Prog>
</Blacklist>
<Whitelist />
</StatusResultList>
Field Definitions
Blacklist
The blacklist is a list of programs that, if running, will cause the beacon to
not attempt communication. For a more detailed description of the
blacklist see the Assassin Receipt file description of blacklist.
Whitelist
The whitelist is a list of programs that must be running for the target to
attempt a beacon. For a more detailed description of the blacklist see the
Assassin Receipt file description of whitelist.
157
SECRET//ORCON//NOFORN