Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//NOFORN
________________________________________________________________________
7. (U) Implant Installation
7.1 (U) Overt Installation on Disk Mode
(S//NF) Once the target is created with the Builder, the implant can be installed with the Installer
DLL. The specific name can be changed when deploying using a DLL file.
• Installer_x64.dll – 64 bit installation DLL
• Installer_x86.dll – 32 bit installation DLL
(S//NF) Another tool is required to load the Installer onto the system. For testing
purposes only, rundll32.exe (with Administrator access) can be used as the loader tool.
However, testing the Installer using rundll32.exe may be flagged by the PSP (see
discussion in Section 10.2).
Usage: rundll32 installer_x64.dll,#2
Note
(S//NF) The Shellterm entry point is at ordinal 1 and the
rundll32 entry point is at ordinal 2.
7.2 (U) Random Access Memory-Only (RAM-Only) Mode
(S//NF) Once the target is created with the Builder, the implant can be run in memory with the
ram_only DLL. The specific name can be changed when deploying via a DLL file.
• ram_only_x64.dll – 64 bit ram-only DLL
• ram_only_x86.dll – 32 bit ram-only DLL
(S//NF) Another tool is required to run the RAM-only instance on a system. For testing,
rundll32.exe can be used as the loader tool.
Usage: rundll32 ram_only_x64.dll,#2
7.3 (U) Implant Offline Installation
(S//NF) The Offline Installer sets up Athena/Hera on an unbooted computer and updates the
computer’s registry. The Installer can be run from a remote operating system by using a Linux
boot disk (e.g., Ubuntu v14.04) or a Windows Installation disk and the Recovery Console.
7.3.1 (U) Offline Windows Installation
(S//NF) The Offline Windows Installer requires a Windows distribution that has an active
Recovery Console. The bitness of the Windows distribution does not affect the installation but
the correct version of the Installer must be run in the console -- the Offline Installer version must
match the bitness of the Windows Recovery Console. Either installation will resolve the correct
target installation files.
• offline_x64.exe – for use with the 64 bit Recovery Console
• offline_x86.exe – for use with the 32 bit Recovery Console
SECRET//NOFORN 23