New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS

Cybersecurity researchers at LevelBlue have identified a new Java-based remote access trojan (RAT) named QuimaRAT, which is capable of targeting Windows, Linux, and macOS environments. The cross-platform malware is being advertised under a malware-as-a-service (MaaS) model, with pricing ranging from $150 for one month to $1,200 for lifetime access.

QuimaRAT features a modular architecture that supports dynamic capability expansion through encrypted plugins delivered, loaded, unloaded, and updated directly from its command-and-control (C2) infrastructure. The malware author offers a builder that can generate multiple output formats, including JAR, EXE, APP, SH, BAT, and VBS, enabling customers to package the client for different environments and delivery scenarios.

The threat actor provides four tools: Quima Control (QuimaRAT), a remote administration tool with 74 Windows and 46 macOS/Linux modules; Quima Builder, a modular builder and launcher toolkit supporting XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, and CHM file formats; Quima Loader, a browser-cache payload delivery service; and Quima Dropper, an HTML/SVG payload generator. Notably, Quima Loader allows operators to upload an EXE file, select a delivery format and landing page template, and generate a stager link that bypasses SmartScreen protections on Windows.

LevelBlue’s analysis reveals QuimaRAT is organized as a modular Java project built using Apache Maven, with embedded Java Native Access (JNA) native libraries for Windows, Linux, and macOS. The malware ensures only one instance runs at a time by creating a lock file in the operating system’s temporary directory. It evades sandboxed and virtual environments, establishes persistence using OS-specific methods (Registry Run keys, Scheduled tasks, Startup folder for Windows; .desktop autostart entries and crontab for Linux; LaunchAgent plist for macOS), and supports an optional Pastebin-based C2 host update mechanism.

QuimaRAT communicates with the C2 server over TCP, WebSocket, TLS, or HTTPS to receive and execute commands. Its capabilities include remote command execution, remote payload and plugin delivery, credential theft, persistence, file transfer, clipboard manipulation, webcam surveillance, and fileless shellcode execution on Windows hosts. LevelBlue assesses QuimaRAT as a modular Java RAT platform designed to rotate static fingerprints without changing core behavior.