Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//NOFORN
3.5 (S//NF) Know Issues and Caveats
3.5.1 CPU usage of the process that CouchPotato is injected into can
potentially be high depending on the number CPUs/Cores available.
In development and testing, it was observed that on a Windows 7 64-
bit VM allocated just one CPU core, the process that CouchPotato
was injected into was using between 50-70% of available CPU while
capturing images of significant change. Memory usage was between
45-50MB.
3.5.2 ffmpeg does support many more arguments than are being
described in this document. However, only the arguments mentioned
in this document have been tested and are known to have no adverse
side-effects. It is beyond the scope of this development effort to
document and test all of ffmpeg’s arguments.
3.5.3 Avoid terminating the cp_handler script prematurely. It was
observed in development and testing that early termination of the pipe
can cause instability in the C2 Loader (such as ShellTerm). Use the
proper command in the C2 Loader to signal (ex ShellTerm – icedll –k
<handle_id>) the ICE DLL execution to stop. Once the C2 Loader
completes it should terminate its connection to pipe which will cause
the handler to exit.
3.5.4 During development and testing it was observed with ShellTerm
2.9.1 that when issuing icedll –k <handle_id> to stop a running
instance of CouchPotato, ShellTerm does not properly signal the
module that it is time to quit. The CouchPotato thread will continue
running in the process until the next attempt to collect data has
occurred. Workarounds in conjunction with issuing an icedll –k are to
also kill the process that CouchPotato was injected into or wait for an
attempt by CouchPotato to write the data back to the C2 Loader (at
which point it will fail, and CouchPotato’s threads will gracefully
exit). This problem is addressed in ShellTerm 2.9.2.
SECRET//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh