QuimaRAT MaaS Delivers Cross-Platform Java RAT for Windows, Linux, and macOS

Researchers have identified QuimaRAT, a Java-based remote access trojan sold through a malware-as-a-service (MaaS) model and built to infect Windows, Linux, and macOS systems. The malware is part of a broader Quima toolkit that includes Quima Builder, Quima Loader, and Quima Dropper, enabling operators to generate payloads in formats such as JAR, EXE, APP, SH, BAT, and VBS, stage delivery through browser-cache techniques, and deploy HTML or SVG droppers. Reported pricing ranges from $150 per month to $1,200 for lifetime access, indicating an effort to lower the barrier for affiliates and other threat actors.

QuimaRAT uses a modular architecture with encrypted plugins and flexible command-and-control over TCP, WebSocket, TLS, and HTTPS, with dynamic C2 rotation reportedly supported through Pastebin-based updates. Analysis found persistence mechanisms tailored to each operating system, along with sandbox evasion, single-instance enforcement, optional decoy execution via a Binder function, and Windows fileless shellcode execution. Once deployed, the RAT can remotely execute commands, steal credentials, transfer files, manipulate the clipboard, conduct webcam surveillance, and expand functionality on demand through additional plugins.