Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Rain Maker v1.0 (Current Version)
SECRET//NOFORN
Rain Maker v1.0
Description:
RainMaker v1.0 is a survey and file collection tool built for a FINO QRC operation. IOC/FINO is looking to expand asset-assisted operations. The intended CONOPS involves using an asset to gain access to a target network. The asset has the ability to plug in a personal thumbdrive to the network. In this scenario, the asset will have "downloaded" the portable version of VLCMediaplayer player (2.1.5) and will listen to music during work hours. While she is listening to music, the tool will execute the survey and a prioritized file collection. All collected data will be stored to the root of the removable media it is executing from. When the asset next meets with the case officer, the thumbdrive is retrieved and the collection is processed.
Design:
Stash Repository: Rain Maker
Testing Repoistory: Rain Maker Dart Tests
Documentation:
('section' missing)
Latest Testing Results:
Operational Use:
JQJHEADSMAN (JQJPOPSTARS/1)
Highlights:
Technique Tracking:
Rain Maker (Unclass)
Buffers - Secure Buffer (needs added)
Survey - SWMI_RoadRunner (needs added)
File Collection - FC_PRI_ORevFCC - FileCriteriaChecker (needs added)
Data Storage - DTNtfsAds_BK
ArrayList
HashList - hashlist2 (needs added)
MD5Functions (needs added)
Rain Maker Stub (Unclass)
Buffers - Secure Buffer (needs added)
Payload Deployment - LoadLibraryFromMemory_INTD
Rain Maker Configurator (Secret//NOFORN)
Misc - MISCFileStateCapture_WIN
Buffers - Secure Buffer (needs added)
Rain Maker Post Processor (Secret//NOFORN)
Data Storage - DTNtfsAds_BK
Buffers - Secure Buffer (needs added)
Change Log:
('excerpt' missing)
Older Versions:
SECRET//NOFORN