# QuimaRAT: Java-based cross-platform Remote Access Trojan offered as Malware-as-a-Service

> QuimaRAT is a Java-based RAT sold as MaaS (USD 150/month to USD 1,200 lifetime) that runs on Windows, Linux and macOS from a single Java payload. It uses a modular design with encrypted plugins pulled from C2, plus a builder, loader and dropper suite that lowers the barrier for low-skill operators.

- **Published:** 2026-11-01T12:42:24Z
- **Last reviewed:** 2026-11-01T12:42:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4995
- **ID:** TL-2026-4995
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

QuimaRAT was documented by LevelBlue SpiderLabs (analysis dated 2026-06-25, blog 2026-07-06, researchers Chen Aviani and Nikita Kazymirskyi) and by Intel 471 in an Emerging Threat report (2026-07-15). It is a modular Java project built with Apache Maven (two distinct pom.xml files) that targets a Java SE 8 JVM and embeds Java Native Access (JNA) native libraries for Windows, Linux and macOS across several CPU architectures. The same Java payload executes on all three operating systems. LevelBlue describes it as a modular Java RAT platform rather than a single static implant. Obfuscation indicators (ProGuard-class renaming, Maven Shade relocation, preserved runtime symbols) suggest the fingerprint can be rotated by the seller.

The seller advertises QuimaRAT v2.0 on dark web forums with claims of 70+ modules, AES-256 encryption, FUD status and a GUI panel. Reported subscription tiers are USD 150 (1 month), 300 (3 months), 500 (6 months), 700 (12 months) and 1,200 (lifetime). One source cites 74 Windows modules and 46 combined macOS/Linux modules. Runtime configuration is held in an encrypted config.dat embedded in the JAR and decrypted with a repeating-key XOR routine. Single-instance enforcement uses a .lock file in the OS temp directory via Java FileLock. Before execution the RAT performs OS-specific virtualization and analysis-environment checks, then installs OS-specific persistence: on Windows, Registry Run keys, scheduled tasks and the Startup folder; on Linux, .desktop autostart entries and crontab @reboot tasks; on macOS, a LaunchAgent plist.

C2 traffic can run over TCP, WebSocket, TLS and HTTPS and uses HANDSHAKE and HEARTBEAT commands for resilience. The configuration can also drive a Pastebin-based C2 host update mechanism. LevelBlue confirmed 23 static commands and found 212 protocol-only commands, which suggests runtime modules, uploaded binaries or fileless payloads delivered after infection (fileless shellcode execution is reported on Windows). Operators extend functionality by deploying encrypted plugins from C2. Because C2 domains vary per buyer, traffic originates from a java process, which can bypass some legacy network controls.

The supporting suite includes Quima Builder, which generates JAR, EXE, APP, SH, BAT and VBS payloads and additional launcher formats (XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, CHM). It also includes Quima Loader, a browser-cache delivery service: a landing page loads, the payload is fetched into the browser cache, a download button appears, the user runs the loader file, and the main payload executes while bypassing Windows SmartScreen. The Hacker News names the dropper Quima Dropper, an HTML/SVG payload generator, and reports 74 Windows and 46 macOS/Linux modules covering remote command execution, payload delivery, credential theft, persistence installation, file transfer, clipboard manipulation and webcam surveillance. Aviatrix reports delivery through deceptive landing pages such as fake CAPTCHA checks or software update alerts. The Hacker News lists one file hash (SHA-256 bb0fbcb1e47ec04aa55555f3769fbc6f09694de1e9baae59260356b26b5af6a7). No accessible source publishes domains, IPs or URLs, and C2 varies per buyer, so no network IOCs could be extracted or checked in BeaconBeagle. The full Intel 471 PDF was not readable. Attribution is unknown: the seller handle 'QuimaCODER' appeared only in a search-result snippet, not in any fetched primary text, and an aggregator's ToddyCat link is uncorroborated by LevelBlue or Intel 471, so neither is used for attribution. Severity MEDIUM is an analyst estimate. Defenders should hunt for java/javaw spawning from Office, script hosts or user-writable paths, new Java-launching persistence, and unexpected outbound connections from Java processes.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1053.003 Cron
- T1543.001 Launch Agent
- T1547.013 XDG Autostart Entries
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1553.005 Mark-of-the-Web Bypass
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1095 Non-Application Layer Protocol
- T1102.001 Dead Drop Resolver
- T1027.006 HTML Smuggling
- T1125 Video Capture

## Sources

- [Emerging Threat: QuimaRAT (Intel 471)](https://www.intel471.com/blog/emerging-threat-quimarat)
- [Novel Java-Based QuimaRAT Targets Windows, macOS and Linux (LevelBlue SpiderLabs)](https://www.levelblue.com/blogs/spiderlabs-blog/novel-java-based-quimarat-targets-windows-macos-and-linux)
- [QuimaRAT: A Java RAT with Burning Ambitions (LevelBlue research report)](https://www.levelblue.com/resources/research-reports/quimarat-a-java-rat-with-burning-ambitions)
- [New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS (The Hacker News)](https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html)
- [QuimaRAT MaaS Sells Cross-Platform Java RAT for Windows, Linux, macOS (Daily Security Review)](https://dailysecurityreview.com/?p=41607)
- [New QuimaRAT malware targets Windows, Linux and macOS via MaaS model (SC Media)](https://www.scworld.com/brief/new-quimarat-malware-targets-windows-linux-and-macos-via-maas-model)
- [QuimaRAT MaaS 2026 (Aviatrix Threat Research Center)](https://aviatrix.ai/threat-research-center/quimarat-maas-2026/)
- [QuimaRAT brief (CraftedSignal)](https://feed.craftedsignal.io/briefs/2026-07-quimarat/)
- [QuimaRAT Java-based MaaS cross-platform detection and defense (Security Arsenal)](https://securityarsenal.com/blog/quimarat-java-based-maas-cross-platform-detection-and-defense)
- [Malware newsletter 2026: QuimaRAT, GodDamn y campañas APT (Moncloa)](https://www.moncloa.com/2026/07/13/malware-newsletter-2026-quimarat-3398789/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4995