Skip to content

S0467 TajMahal

TajMahal is a multifunctional spying framework that has been in use since at least 2014. TajMahal is comprised of two separate packages, named Tokyo and Yokohama, and can deploy up to 80 plugins.1

Item Value
ID S0467
Associated Names
Type MALWARE
Version 1.0
Created 08 June 2020
Last Modified 15 June 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1560 Archive Collected Data -
enterprise T1560.002 Archive via Library TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.1
enterprise T1123 Audio Capture TajMahal has the ability to capture VoiceIP application audio on an infected host.1
enterprise T1119 Automated Collection TajMahal has the ability to index and compress files into a send queue for exfiltration.1
enterprise T1020 Automated Exfiltration TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.1
enterprise T1115 Clipboard Data TajMahal has the ability to steal data from the clipboard of an infected host.1
enterprise T1005 Data from Local System TajMahal has the ability to steal documents from the local system including the print spooler queue.1
enterprise T1025 Data from Removable Media TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.1
enterprise T1041 Exfiltration Over C2 Channel TajMahal has the ability to send collected files over its C2.1
enterprise T1083 File and Directory Discovery TajMahal has the ability to index files from drives, user profiles, and removable drives.1
enterprise T1056 Input Capture -
enterprise T1056.001 Keylogging TajMahal has the ability to capture keystrokes on an infected host.1
enterprise T1112 Modify Registry TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers to enable document stealing.1
enterprise T1027 Obfuscated Files or Information TajMahal has used an encrypted Virtual File System to store plugins.1
enterprise T1120 Peripheral Device Discovery TajMahal has the ability to identify connected Apple devices.1
enterprise T1057 Process Discovery TajMahal has the ability to identify running processes and associated plugins on an infected host.1
enterprise T1055 Process Injection -
enterprise T1055.001 Dynamic-link Library Injection TajMahal has the ability to inject DLLs for malicious plugins into running processes.1
enterprise T1113 Screen Capture TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.1
enterprise T1129 Shared Modules TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.1
enterprise T1518 Software Discovery TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.1
enterprise T1518.001 Security Software Discovery TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.1
enterprise T1539 Steal Web Session Cookie TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.1
enterprise T1082 System Information Discovery TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.1
enterprise T1016 System Network Configuration Discovery TajMahal has the ability to identify the MAC address on an infected host.1
enterprise T1124 System Time Discovery TajMahal has the ability to determine local time on a compromised host.1
enterprise T1125 Video Capture TajMahal has the ability to capture webcam video.1

References

  1. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩