Kaspersky TajMahal April 2019

TajMahal has the ability to steal documents from the local system including the print spooler queue.

TajMahal has the ability to identify the MAC address on an infected host.

TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.

TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.

TajMahal has used an encrypted Virtual File System to store plugins.

TajMahal has the ability to send collected files over its C2.

TajMahal has the ability to inject DLLs for malicious plugins into running processes.

TajMahal has the ability to capture keystrokes on an infected host.

TajMahal has the ability to identify running processes and associated plugins on an infected host.

TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.

TajMahal has the ability to index files from drives, user profiles, and removable drives.

TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers to enable document stealing.

TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.

TajMahal has the ability to steal data from the clipboard of an infected host.

TajMahal has the ability to index and compress files into a send queue for exfiltration.

TajMahal has the ability to identify connected Apple devices.

TajMahal has the ability to capture VoiceIP application audio on an infected host.

TajMahal has the ability to determine local time on a compromised host.

TajMahal has the ability to capture webcam video.

TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.

TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.

TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.

TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.

TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.