Executive Summary
QuimaRAT is a Java-based remote access trojan (RAT) published by LevelBlue SpiderLabs on June 25, 2026 and further covered by The Hacker News on July 6, 2026. What stands out: it runs on Windows, macOS, and Linux, is sold on the dark web under a malware-as-a-service (MaaS) model priced from \(150/month to \)1,200 lifetime, and is advertised as version "v2.0" with "70+ modules," "AES-256 encryption," "FUD (Fully Undetectable)," and a GUI panel.
The core business risk comes from four combined factors. First, its genuinely cross-platform architecture — thanks to embedded Java Native Access (JNA) libraries for multiple OSes/architectures — lets a single payload control a mixed environment. Second, its modular architecture via encrypted plugins loaded/unloaded/updated directly from C2, plus fileless shellcode on Windows, means its capabilities shift dynamically after compromise. Third, the seller packages an entire toolkit (the Quima suite) — builder, loader, and dropper — lowering the technical bar for buyers. Fourth, the seller deliberately labels it an "offensive security tool" with a disclaimer — a textbook MaaS legal-cover tactic. For defenders, the priority is monitoring anomalous Java process behavior rather than relying on signatures, since QuimaRAT is designed to rotate static fingerprints.
MaaS profile & the Quima suite
QuimaRAT isn't sold as a lone implant but as a tooling ecosystem. Per The Hacker News, the seller offers four components:
Quima Control (i.e. QuimaRAT) — a remote administration tool with 74 Windows modules and 46 macOS/Linux modules.
Quima Builder — a modular builder/launcher toolkit supporting many formats: XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, and CHM.
Quima Loader — a browser-cache payload delivery service (detailed in "Payload delivery" below).
Quima Dropper — an HTML/SVG payload generator. The builder can produce multiple output formats — JAR, EXE, APP, SH, BAT, VBS — showing an effort to help customers package the client for different environments and delivery scenarios. The MaaS pricing tiers are $150 (1 month), $300 (3 months), $500 (6 months), $700 (12 months), and $1,200 lifetime.
On the "cover story": visiting the tool's website greets users with a pop-up asserting the platform is only for professional security research, authorized penetration testing, and controlled educational environments, warning against unauthorized use. In practice, anonymous dark-web sale under a "FUD" label and a guarantee of complete stealth on Windows/Linux makes clear this disclaimer is just legal cover.
Architecture & execution chain
Technically, LevelBlue identifies QuimaRAT as a modular Java project built with Apache Maven (it has two pom.xml files), running on the JVM (Java SE 8), with embedded JNA native libraries for Windows, Linux, and macOS across various architectures. These native components let the RAT call low-level OS APIs directly through C/C++ code — a clear signal of intent for deep multi-platform support.
Execution chain on the victim machine:
Load configuration — QuimaRAT reads an encrypted config.dat embedded in the JAR, decrypting it with a repeating-key XOR routine; this config drives environment validation, persistence installation, and C2 initialization.
Single-instance — it creates a .lock file in the OS temp directory and locks it via Java FileLock; if another instance already holds the lock, the process terminates, ensuring only one copy runs.
OS detection & anti-analysis — it determines the current OS name to dictate the next steps, including OS-specific sandbox/virtualization evasion.
Binder (optional) — if enabled in the config, it runs an additional embedded payload or decoy application alongside the main RAT process.
Install persistence & initialize C2 (below).
Per-OS persistence
QuimaRAT establishes persistence using OS-specific mechanisms:
Windows: Registry Run keys, Scheduled tasks, and the Startup folder.
Linux: .desktop autostart entries and crontab reboot tasks.
macOS: a LaunchAgent plist. Covering all three OSes with native mechanisms shows QuimaRAT isn't a crude port but is designed to persist durably across every target environment.
C2 & capabilities
The end goal is establishing a channel with C2 to receive and execute commands. QuimaRAT uses TCP as its primary channel, with WebSocket, TLS, and HTTPS alternatives. To keep the channel resilient:
HANDSHAKE and HEARTBEAT commands maintain and confirm the connection.
A watchdog ensures the channel stays active and reconnects if contact is lost.
An internal shutdown-state flag controls whether the RAT continues networking/reconnect/watchdog/recovery operations — letting it fully stop when shutdown mode is triggered.
An optional Pastebin-based C2 host update mechanism (config-controlled) lets the operator rotate or replace C2 infrastructure without rebuilding and redistributing the payload. Static analysis confirmed 23 implemented commands plus 212 protocol-only commands — indicating the operator likely expands functionality through runtime modules, uploaded binaries, or fileless payloads. Capabilities include remote command execution, remote payload/plugin delivery, credential theft, file transfer, clipboard manipulation, webcam surveillance, and notably fileless shellcode execution on Windows — a significant extension over a conventional RAT.
Quima Loader payload delivery
Quima Loader is the most notable component for delivery. Per the developer's own description, an operator uploads an EXE through a dedicated panel, selects a delivery format (e.g. HTA or LNK) and a landing-page template (e.g. a fake CAPTCHA check or software-update alert), after which the tool generates a stager link. When the victim opens it in a browser:
1. The landing page loads; the payload is fetched and held in the browser cache
2. A Download button appears on the page
3. The victim clicks → saves a "small, clean loader file" trusted by the browser
4. The victim runs the loader → it reads the cached payload
5. The main payload executes on the system, bypassing SmartScreen on Windows
The crux of this technique is abusing what Windows already trusts: the main payload is never downloaded directly but sits in the browser cache, while the file the user actually downloads is a "clean" loader — enough to evade SmartScreen and avoid raising suspicion from user or AV.
Evasion & fingerprint rotation
Beyond the advertised AES-256 and XOR for config.dat, LevelBlue assesses that QuimaRAT should be viewed as a modular Java RAT platform rather than a single static implant. Indicators such as ProGuard-class obfuscation, Maven Shade relocation, preserved runtime symbols, and synthetic string decryptors show it's designed to rotate static fingerprints without changing its core behavior. This is precisely why signature-based defense is easily bypassed: each build can look statically different while behaving identically at runtime.
Assessment
QuimaRAT reflects two notable trends. First, cross-platform RATs on Java lower the bar for attackers wanting to target mixed Windows/macOS/Linux environments from a single codebase — instead of developing and maintaining multiple implants. Second, the MaaS model bundling builder–loader–dropper turns malware delivery into a "pick a format, pick a template" process that buyers can run without deep technical skill.
For enterprise environments in Vietnam, the concern is that the Java runtime is widespread (many business, banking, and ERP applications run on Java), so a malicious JAR blends into legitimate activity more easily than an unfamiliar binary. Additionally, the "offensive security tool" cover with a disclaimer is a legal-evasion tactic that should be recognized for what it is: a tool sold anonymously, promising FUD and complete stealth, makes its real purpose fairly clear.
IOCs (Indicators of Compromise)
The public portion of both sources has no hard C2 IP/domain (C2 rotates via Pastebin and config). The analyzed sample:
SHA256: bb0fbcb1e47ec04aa55555f3769fbc6f09694de1e9baae59260356b26b5af6a7 (QuimaRAT JAR sample)
Source: the sample referenced on VirusTotal per The Hacker News. More complete IOCs (if any) are in LevelBlue's full report.
Recommendations
Monitor Java process behavior: alert on java/javaw running a JAR from temp/user paths, dropping JNA native libraries, or creating a .lock in temp; prioritize behavioral-chain detection over signatures.
Sweep cross-platform persistence: scan Run keys/scheduled tasks/Startup (Windows), .desktop autostart + crontab (Linux), LaunchAgent plists (macOS) correlated with unfamiliar Java processes.
Break the Quima Loader chain: enable SmartScreen/AppLocker/WDAC, monitor "loader" files downloaded from a browser that then execute; be wary of fake CAPTCHA/update landing pages.
Ingest the hash above into EDR/SIEM and monitor anomalous outbound from Java processes (including requests to Pastebin).
References
