# QuimaRAT: A Cross-Platform Java RAT (Windows/macOS/Linux) Sold as MaaS, 70+ Modules Behind an "Offensive Security" Cover

## Executive Summary

**QuimaRAT** is a Java-based remote access trojan (RAT) [published by LevelBlue SpiderLabs on June 25, 2026](https://www.levelblue.com/blogs/spiderlabs-blog/novel-java-based-quimarat-targets-windows-macos-and-linux) and [further covered by The Hacker News on July 6, 2026](https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html). What stands out: it runs on **Windows, macOS, and Linux**, is sold on the dark web under a **malware-as-a-service (MaaS)** model priced from $150/month to $1,200 lifetime, and is advertised as version "v2.0" with "70+ modules," "AES-256 encryption," "FUD (Fully Undetectable)," and a GUI panel.

The core business risk comes from four combined factors. First, its **genuinely cross-platform** architecture — thanks to embedded Java Native Access (JNA) libraries for multiple OSes/architectures — lets a single payload control a mixed environment. Second, its **modular architecture via encrypted plugins** loaded/unloaded/updated directly from C2, plus **fileless shellcode on Windows**, means its capabilities shift dynamically after compromise. Third, the seller packages an entire **toolkit (the Quima suite)** — builder, loader, and dropper — lowering the technical bar for buyers. Fourth, the seller deliberately labels it an "offensive security tool" with a disclaimer — a textbook MaaS legal-cover tactic. For defenders, the priority is **monitoring anomalous Java process behavior** rather than relying on signatures, since QuimaRAT is designed to rotate static fingerprints.

## MaaS profile & the Quima suite

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/d08613bd-24e1-463e-9b3a-1be73404b9e0.png align="center")

QuimaRAT isn't sold as a lone implant but as a tooling ecosystem. Per [The Hacker News](https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html), the seller offers four components:

*   **Quima Control** (i.e. QuimaRAT) — a remote administration tool with **74 Windows modules** and **46 macOS/Linux modules**.
    
*   **Quima Builder** — a modular builder/launcher toolkit supporting many formats: XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, and CHM.
    
*   **Quima Loader** — a browser-cache payload delivery service (detailed in "Payload delivery" below).
    
*   **Quima Dropper** — an HTML/SVG payload generator. The builder can produce multiple output formats — JAR, EXE, APP, SH, BAT, VBS — showing an effort to help customers package the client for different environments and delivery scenarios. The MaaS pricing tiers are $150 (1 month), $300 (3 months), $500 (6 months), $700 (12 months), and $1,200 lifetime.
    

On the "cover story": visiting the tool's website greets users with a pop-up asserting the platform is only for professional security research, authorized penetration testing, and controlled educational environments, warning against unauthorized use. In practice, anonymous dark-web sale under a "FUD" label and a guarantee of complete stealth on Windows/Linux makes clear this disclaimer is just legal cover.

## Architecture & execution chain

Technically, [LevelBlue](https://www.levelblue.com/blogs/spiderlabs-blog/novel-java-based-quimarat-targets-windows-macos-and-linux) identifies QuimaRAT as a **modular Java project built with Apache Maven** (it has two `pom.xml` files), running on the JVM (Java SE 8), with embedded JNA native libraries for Windows, Linux, and macOS across various architectures. These native components let the RAT call low-level OS APIs directly through C/C++ code — a clear signal of intent for deep multi-platform support.

Execution chain on the victim machine:

1.  **Load configuration** — QuimaRAT reads an encrypted `config.dat` embedded in the JAR, decrypting it with a **repeating-key XOR** routine; this config drives environment validation, persistence installation, and C2 initialization.
    
2.  **Single-instance** — it creates a `.lock` file in the OS temp directory and locks it via Java `FileLock`; if another instance already holds the lock, the process terminates, ensuring only one copy runs.
    
3.  **OS detection & anti-analysis** — it determines the current OS name to dictate the next steps, including OS-specific sandbox/virtualization evasion.
    
4.  **Binder (optional)** — if enabled in the config, it runs an additional embedded payload or decoy application alongside the main RAT process.
    
5.  **Install persistence & initialize C2** (below).
    

## Per-OS persistence

QuimaRAT establishes persistence using OS-specific mechanisms:

*   **Windows**: Registry Run keys, Scheduled tasks, and the Startup folder.
    
*   **Linux**: `.desktop` autostart entries and crontab reboot tasks.
    
*   **macOS**: a LaunchAgent plist. Covering all three OSes with native mechanisms shows QuimaRAT isn't a crude port but is designed to persist durably across every target environment.
    

## C2 & capabilities

The end goal is establishing a channel with C2 to receive and execute commands. QuimaRAT uses **TCP** as its primary channel, with **WebSocket, TLS, and HTTPS** alternatives. To keep the channel resilient:

*   **HANDSHAKE** and **HEARTBEAT** commands maintain and confirm the connection.
    
*   A **watchdog** ensures the channel stays active and reconnects if contact is lost.
    
*   An internal **shutdown-state flag** controls whether the RAT continues networking/reconnect/watchdog/recovery operations — letting it fully stop when shutdown mode is triggered.
    
*   An optional **Pastebin-based C2 host update** mechanism (config-controlled) lets the operator rotate or replace C2 infrastructure **without rebuilding and redistributing the payload**. Static analysis confirmed **23 implemented commands** plus **212 protocol-only commands** — indicating the operator likely expands functionality through runtime modules, uploaded binaries, or fileless payloads. Capabilities include remote command execution, remote payload/plugin delivery, credential theft, file transfer, clipboard manipulation, webcam surveillance, and notably **fileless shellcode execution on Windows** — a significant extension over a conventional RAT.
    

## Quima Loader payload delivery

**Quima Loader** is the most notable component for delivery. Per the developer's own description, an operator uploads an EXE through a dedicated panel, selects a delivery format (e.g. HTA or LNK) and a landing-page template (e.g. a fake CAPTCHA check or software-update alert), after which the tool generates a **stager link**. When the victim opens it in a browser:

```plaintext
1. The landing page loads; the payload is fetched and held in the browser cache
2. A Download button appears on the page
3. The victim clicks → saves a "small, clean loader file" trusted by the browser
4. The victim runs the loader → it reads the cached payload
5. The main payload executes on the system, bypassing SmartScreen on Windows
```

The crux of this technique is abusing what Windows already trusts: the main payload is never downloaded directly but sits in the browser cache, while the file the user actually downloads is a "clean" loader — enough to evade SmartScreen and avoid raising suspicion from user or AV.

## Evasion & fingerprint rotation

Beyond the advertised AES-256 and XOR for `config.dat`, LevelBlue assesses that QuimaRAT should be viewed as **a modular Java RAT platform rather than a single static implant**. Indicators such as ProGuard-class obfuscation, Maven Shade relocation, preserved runtime symbols, and synthetic string decryptors show it's designed to **rotate static fingerprints without changing its core behavior**. This is precisely why signature-based defense is easily bypassed: each build can look statically different while behaving identically at runtime.

## Assessment

QuimaRAT reflects two notable trends. First, **cross-platform RATs on Java** lower the bar for attackers wanting to target mixed Windows/macOS/Linux environments from a single codebase — instead of developing and maintaining multiple implants. Second, the **MaaS model bundling builder–loader–dropper** turns malware delivery into a "pick a format, pick a template" process that buyers can run without deep technical skill.

For enterprise environments in Vietnam, the concern is that the Java runtime is widespread (many business, banking, and ERP applications run on Java), so a malicious JAR blends into legitimate activity more easily than an unfamiliar binary. Additionally, the "offensive security tool" cover with a disclaimer is a legal-evasion tactic that should be recognized for what it is: a tool sold anonymously, promising FUD and complete stealth, makes its real purpose fairly clear.

## IOCs (Indicators of Compromise)

The public portion of both sources **has no hard C2 IP/domain** (C2 rotates via Pastebin and config). The analyzed sample:

```plaintext
SHA256: bb0fbcb1e47ec04aa55555f3769fbc6f09694de1e9baae59260356b26b5af6a7   (QuimaRAT JAR sample)
```

Source: the sample referenced on [VirusTotal](https://www.virustotal.com/gui/file/bb0fbcb1e47ec04aa55555f3769fbc6f09694de1e9baae59260356b26b5af6a7) per The Hacker News. More complete IOCs (if any) are in [LevelBlue's full report](https://www.levelblue.com/resources/research-reports/quimarat-a-java-rat-with-burning-ambitions).

## Recommendations

*   **Monitor Java process behavior**: alert on `java/javaw` running a JAR from temp/user paths, dropping JNA native libraries, or creating a `.lock` in temp; prioritize behavioral-chain detection over signatures.
    
*   **Sweep cross-platform persistence**: scan Run keys/scheduled tasks/Startup (Windows), `.desktop` autostart + crontab (Linux), LaunchAgent plists (macOS) correlated with unfamiliar Java processes.
    
*   **Break the Quima Loader chain**: enable SmartScreen/AppLocker/WDAC, monitor "loader" files downloaded from a browser that then execute; be wary of fake CAPTCHA/update landing pages.
    
*   **Ingest the hash** above into EDR/SIEM and monitor anomalous outbound from Java processes (including requests to Pastebin).
    

* * *

## References

*   LevelBlue SpiderLabs — [*Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux*](https://www.levelblue.com/blogs/spiderlabs-blog/novel-java-based-quimarat-targets-windows-macos-and-linux)
    
*   The Hacker News — [*New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS*](https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html)
    
*   LevelBlue (full report) — [*QuimaRAT: A Java RAT with Burning Ambitions*](https://www.levelblue.com/resources/research-reports/quimarat-a-java-rat-with-burning-ambitions)