Analysis Describes QuimaRAT, a Java RAT Targeting Windows, macOS and Linux
Summary
A LevelBlue analysis describes QuimaRAT, a Java RAT marketed as a subscription MaaS targeting Windows, macOS and Linux. The analyzed sample uses encrypted configuration, environment checks, OS-specific persistence and HANDSHAKE/HEARTBEAT C2 commands.
Key points
- The seller markets QuimaRAT v2.0 as a subscription malware-as-a-service platform and advertises more than 70 modules, AES-256 encryption, FUD capabilities and a GUI.
- The analyzed Java SE 8 JAR contains embedded Java Native Access libraries for Windows, Linux and macOS across multiple architectures.
- The sample decrypts an embedded config.dat file using a repeating-key XOR routine.
- It uses a temporary-directory .lock file and Java FileLock to enforce single-instance execution.
- The sample checks for virtualization and analysis environments and installs OS-specific persistence mechanisms.
- Its C2 communication uses HANDSHAKE and HEARTBEAT commands.
- Static analysis identified 23 implemented commands and 212 protocol-only commands; the researchers say this may allow the operator to expand functionality.
Article Details
- Event Type
- Analysis of QuimaRAT, a Java-based remote access trojan advertised for sale as a subscription malware-as-a-service platform.
- Impact
- The analyzed sample targets Windows, Linux, and macOS. It uses OS-specific persistence and virtualization and analysis-environment checks, decrypts an embedded configuration file with repeating-key XOR, and maintains C2 communications using HANDSHAKE and HEARTBEAT commands. The article reports no specific victims or confirmed impact.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe sample stores an encrypted config.dat inside its JAR archive.T1071 · Application Layer ProtocolThe RAT uses HANDSHAKE and HEARTBEAT commands to maintain C2 communications.T1132 · Data EncodingThe embedded config.dat is decrypted using a repeating-key XOR routine.T1497 · Virtualization/Sandbox EvasionThe analyzed RAT checks for virtualization and analysis environments before execution.T1547 · Boot or Logon Autostart ExecutionThe analyzed RAT installs OS-specific persistence mechanisms.
Malware
Products
LinuxQuimaRAT is a new Java-based RAT sold on the dark web as a subscription MaaS platform that targets Windows, Linux, and macOS with modular features and OS-specific capabilities.macOSQuimaRAT is a new Java-based RAT sold on the dark web as a subscription MaaS platform that targets Windows, Linux, and macOS with modular features and OS-specific capabilities.Microsoft WindowsQuimaRAT is a new Java-based RAT sold on the dark web as a subscription MaaS platform that targets Windows, Linux, and macOS with modular features and OS-specific capabilities.