Security researchers flagged a new Java-based remote access trojan called QuimaRAT that targets Windows, Linux, and macOS. LevelBlue spotted it being sold as a malware-as-a-service operation.
Pricing runs from $150 for one month to $1,200 for lifetime access. There are tiers in between: $300 for three months, $500 for six, $700 for a year.
The trojan uses a modular architecture with encrypted plugins delivered straight from its C2 infrastructure. The seller provides a builder that can generate payloads in JAR, EXE, APP, SH, BAT, and VBS formats — covering just about every delivery scenario.
Their website claims “complete stealth” on Windows and Linux with no visible UI or desktop entries. On macOS, they’re honest that screen capture and input control need user-granted admin permissions. The front page includes the usual “for authorized testing only” disclaimer.
The full suite includes four tools: QuimaRAT (the remote admin tool with 74 Windows modules and 46 macOS/Linux modules), Quima Builder (supports XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, CHM), Quima Loader (browser-cache payload delivery), and Quima Dropper (HTML/SVG payload generator).
Quima Loader’s clever — it lets an operator upload an EXE, pick a delivery format like HTA or LNK, choose a landing page template (fake CAPTCHA, software update), and generates a stager link. When the victim opens it, the payload lands in browser cache, a small trusted loader file downloads, and the main payload executes while bypassing Windows SmartScreen.
The malware maintains persistence via Registry Run keys, scheduled tasks, Startup folders (Windows), .desktop autostart entries and crontab (Linux), and LaunchAgent plist (macOS). It also has an optional Pastebin-based C2 host update mechanism — letting operators rotate infrastructure without rebuilding the payload.
Capabilities include remote command execution, credential theft, file transfer, clipboard manipulation, webcam surveillance, and fileless shellcode execution on Windows.
