Loading malware…
24 distinct techniques documented for this family, organized by ATT&CK tactic.
QuimaRAT employs various persistence methods, such as Registry Run keys, Scheduled tasks... and crontab on Linux...
It can execute commands remotely...
TTP # T1059.007 — Command and Scripting Interpreter: JavaScript (Execution)
These native components allow the RAT to interact directly with low-level operating system APIs through C/C++ code, indicating intentional support for broad multi-platform deployment.
Built around a modular architecture, the RAT supports dynamic capability expansion through encrypted plugins that can be delivered, loaded, unloaded, and updated directly from its command-and-control (C2) infrastructure.
A Download button appears on the page. Clicking it saves a 'small, clean loader file' that's trusted by the browser. Target runs the loader, which reads the cached payload. The main payload gets executed on the system...
QuimaRAT employs various persistence methods, such as Registry Run keys, Scheduled tasks... and crontab on Linux...
The malware sets up persistence using a variety of operating system-specific methods: ... and a LaunchAgent plist file for macOS.
TTP # T1547 — Boot or Logon Autostart Execution (Persistence)
QuimaRAT employs various persistence methods, such as Registry Run keys, Scheduled tasks, Startup folder on Windows...
QuimaRAT employs various persistence methods, such as Registry Run keys, Scheduled tasks... and crontab on Linux...
The malware sets up persistence using a variety of operating system-specific methods: ... and a LaunchAgent plist file for macOS.
TTP # T1547 — Boot or Logon Autostart Execution (Persistence)
QuimaRAT employs various persistence methods, such as Registry Run keys, Scheduled tasks, Startup folder on Windows...
TTP # T1027 — Obfuscated Files or Information (Defense Evasion)
Quima Loader ... allows an operator to upload an EXE file ... The landing page is loaded, and the payload is fetched and held in the browser cache.
Chargement d’un fichier de configuration chiffré config.dat embarqué dans le JAR, déchiffré via une routine XOR à clé répétée
The author behind the Quima suite claims on their website. 'Native execution paths, system-owned resources, clean outputs.' | The main payload gets executed on the system, while bypassing SmartScreen protections on Windows.
Vérifications anti-virtualisation et anti-analyse spécifiques à l’OS avant exécution
QuimaRAT is designed to determine the current operating system name, using it to dictate the next course of action...
The malware supports a wide range of capabilities, including remote command execution, remote payload and plugin delivery, credential theft...
It can execute commands remotely, steal credentials, transfer files, manipulate the clipboard, and conduct webcam surveillance...
The malware supports a wide range of capabilities, including remote command execution, remote payload and plugin delivery, credential theft, persistence, file transfer, clipboard manipulation, and webcam surveillance...
Vérifications anti-virtualisation et anti-analyse spécifiques à l’OS avant exécution
QuimaRAT is designed to determine the current operating system name, using it to dictate the next course of action...
It can execute commands remotely, steal credentials, transfer files, manipulate the clipboard...
It can execute commands remotely, steal credentials, transfer files, manipulate the clipboard, and conduct webcam surveillance...
TTP # T1071 — Application Layer Protocol (Command and Control)
QuimaRAT features a modular architecture, allowing for dynamic expansion of capabilities through encrypted plugins delivered via its command-and-control (C2) infrastructure.
TTP # T1573 — Encrypted Channel (Command and Control)
It can execute commands remotely, steal credentials, transfer files...
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.