Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//20341105
3.9.3 (S) Adding a driver or executable to the covert file system with a one-time delay
(-t)
(S) Angelfire is capable of executing both applications and drivers at a later date and
time. This accomplished by using the -t option with the following date/time format:
YYYY:MM:DD:HH:MM:SS. For example, to execute an implant on July 4th, 2011 at
1:00pm, you would use the following command:
stp.exe –f c:\tmp\xserver.exe -t 2011:07:04:13:00:00 -c -a
10.3.2.130 -p 1999
The -t option must be used directly before the -c option (if one is specified) and before
the
-i option (if one is specified).
3.9.4 (S) Periodically executing an application with an interval (-i)
(S) Angelfire can periodically execute applications with a user defined interval. The user
specifies the interval in minutes and immediately after that, specifies a time delta in
seconds. The delta is used to calculate a random number that is no larger than the delta.
That number is then added to the interval value to provide bounded randomness to the
execution interval. An interval less than 2 minutes should not be used due to
inconsistent behavior in MagicWand (see Known Issues). The following example
executes an application with an interval of 5 minutes and a delta of 60 seconds:
stp.exe –f c:\tmp\xserver.exe -i 5 60 -c -a 10.3.2.130 -p
1999
The -i option must be used directly before the -c option and after the -t option.
Additionally, the -i option cannot be used with drivers.
3.9.5 (S) Adding a permanent delay (-p)
(S) Angelfire can apply a delay to execution of user applications or drivers. The delay is
specified in seconds and is fixed (no delta is applied). There are some rules with regards
to when and how the delay is applied. First, it is applied after any date/time delay (-t).
Second, it is not applied during any interval-based (-i) re executions. Third, it does not go
away (unlike –t). Every reboot, the delay will be applied. The permanent delay should
be used after a –t and before a –i. Here is an example of applying a 30 second permanent
delay:
stp.exe –f c:\tmp\xserver.exe -p 30 -c -a 10.3.2.130 -p 1999
af+mainrepo+wolfcreek+Docs+Angelfire_UserGuide
12 of 21
SECRET//20341105

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh