Skip to content

Hide Navigation Hide TOC

TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70)

TajMahal is a multifunctional spying framework that has been in use since at least 2014. TajMahal is comprised of two separate packages, named Tokyo and Yokohama, and can deploy up to 80 plugins.(Citation: Kaspersky TajMahal April 2019)

Cluster A Galaxy A Cluster B Galaxy B Level
Archive via Library - T1560.002 (41868330-6ee2-4d0f-b743-9f2294c3c9b6) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945) Attack Pattern 1
Shared Modules - T1129 (0a5231ec-41af-4a35-83d0-6bdf11f28c65) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Automated Exfiltration - T1020 (774a3188-6ba9-4dc4-879d-d54ee48a5ce9) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4) Attack Pattern 1
System Time Discovery - T1124 (f3c544dc-673c-4ef3-accb-53229f1ae077) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Steal Web Session Cookie - T1539 (10ffac09-e42d-4f56-ab20-db94c67d76ff) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Data from Local System - T1005 (3c4a2599-71ee-4405-ba1e-0e28414b4bc5) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Exfiltration Over C2 Channel - T1041 (92d7da27-2d91-488e-a00c-059dc162766d) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Data from Removable Media - T1025 (1b7ba276-eedc-4951-a762-0ceea2c030ec) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware Software Discovery - T1518 (e3b6daca-e963-4a69-aee6-ed4fd653ad58) Attack Pattern 1
Clipboard Data - T1115 (30973a08-aed9-4edf-8604-9084ce1b5c4f) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Automated Collection - T1119 (30208d3e-0d6b-43c8-883e-44462a514619) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware Audio Capture - T1123 (1035cdf2-3e5f-446f-a7a7-e8f6d7925967) Attack Pattern 1
TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware Security Software Discovery - T1518.001 (cba37adb-d6fb-4610-b069-dd04c0643384) Attack Pattern 1
TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware Peripheral Device Discovery - T1120 (348f1eef-964b-4eb6-bb53-69b3dcb0c643) Attack Pattern 1
Video Capture - T1125 (6faf650d-bf31-4eb4-802d-1000cf38efaf) Attack Pattern TajMahal - S0467 (b51797f7-57da-4210-b8ac-b8632ee75d70) Malware 1
Archive via Library - T1560.002 (41868330-6ee2-4d0f-b743-9f2294c3c9b6) Attack Pattern Archive Collected Data - T1560 (53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a) Attack Pattern 2
Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) Attack Pattern Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945) Attack Pattern 2
Input Capture - T1056 (bb5a00de-e086-4859-a231-fa793f6797e2) Attack Pattern Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4) Attack Pattern 2
Software Discovery - T1518 (e3b6daca-e963-4a69-aee6-ed4fd653ad58) Attack Pattern Security Software Discovery - T1518.001 (cba37adb-d6fb-4610-b069-dd04c0643384) Attack Pattern 2