QuimaRAT — Cross-Platform Java RAT (MaaS)

QuimaRAT is a newly documented Java-based remote access trojan (LevelBlue SpiderLabs, surfaced in the current cycle and widely reported 2026-07-06) sold under a malware-as-a-service model. It is a modular Apache Maven project targeting Java SE 8, bundling JNA native libraries for Windows, Linux, and macOS so a single payload runs cross-platform. The operator suite ships a Builder, Loader, and Dropper that generate lures in many formats (JAR, EXE, APP, SH, BAT, VBS, plus LNK/VBS/JS/DOCM/XLSM/CHM variants).

Capabilities include remote command execution, plugin/payload delivery, credential theft, file transfer, clipboard manipulation, webcam surveillance, and fileless shellcode execution on Windows. It establishes a single-instance .lock file in the OS temp directory (Java FileLock), stores an XOR-encrypted config.dat, communicates over TCP / WebSocket / TLS / HTTPS with AES-256 encryption, and supports an optional Pastebin-hosted C2-rotation mechanism so operators can swap infrastructure without rebuilding the client.

Highest-value defensive angle: because QuimaRAT rides the Java runtime, the durable signal is the Java process itself behaving like malware — javaw.exe launched by an Office app or script host, a -jar executed from a user-writable/temp path, and per-OS autoruns (Run key / Scheduled Task / Startup folder on Windows; crontab and .desktop on Linux; a LaunchAgent plist on macOS) that point back at a Java payload.

Intel note: this is a behavioral hunt. The public reporting details TTPs and artifacts but does not publish a corroborated atomic IOC set (hashes/C2). The IOC appendix therefore ships behavioral signatures and placeholders — replace the hash/C2 placeholders with values from your own sandboxing or a vetted feed before enabling blocking.

Defender priority: Hunt javaw.exe/java.exe spawned by an Office or script-host parent, and any autorun (Run key / task / Startup / LaunchAgent / crontab) whose target is a Java runtime running a JAR from a temp path — these catch QuimaRAT regardless of the builder-chosen lure format.

Web-hunter note: Two independent reports describe consistent TTPs; no vendor has yet published a vetted hash/C2 IOC list. Confidence in the behavior is high; atomic-indicator coverage is a known gap (see §15).

Hunt hypotheses (ordered by fidelity)

1. H1 — Java from a lure parent (high): javaw.exe/java.exe spawned by an Office app or script host (wscript/cscript/mshta) indicates a QuimaRAT dropper lure detonating.
2. H2 — JAR from temp (high): a Java runtime executing -jar against a path in Temp/AppData/Downloads/ProgramData.
3. H3 — Run-key persistence (high): a registry Run value whose data invokes a Java runtime + .jar.
4. H4 — Scheduled-task persistence (medium): a task action launching javaw.exe -jar.
5. H5 — Startup-folder persistence (medium): a .jar/.lnk written into a Startup directory.
6. H6 — Pastebin C2 rotation (medium): DNS/HTTP to pastebin.com from a Java process (config-driven C2 update).
7. H7 — Runtime artifacts (medium): creation of a temp .lock single-instance file and an XOR-encrypted config.dat beside a JAR.
8. H8 — Java C2 beacon (medium): a Java process holding sustained outbound TCP/WebSocket sessions to non-corporate hosts.

Attack chain

No vetted atomic IOCs (file hashes / C2 addresses) are published for QuimaRAT at time of writing. The table below lists behavioral and artifact indicators from the LevelBlue analysis — durable across builder-chosen lure formats. Populate atomic IOCs from your own detonation before enabling prevention.

• macOS — LaunchAgent: new plist under ~/Library/LaunchAgents or /Library/LaunchAgents whose ProgramArguments invoke java/-jar; review with launchctl list.
• Linux — crontab / autostart: @reboot crontab entries or ~/.config/autostart/*.desktop files launching a JRE; audit crontab -l and the autostart dirs.
• Windows Security 4698 — scheduled-task creation with an action pointing at javaw.exe -jar.
• Sysmon Event 11 — .jar, config.dat, or .lock written into Temp/AppData/Startup.
• Sysmon Event 13 / Registry auditing — Run-key values referencing a Java runtime.
• Proxy / DNS logs — requests to pastebin.com (raw paste paths) originating from a Java user-agent or host running Java.

All queries are Investigate-only until you baseline Java usage. Promote the Office→Java IOA first (narrowest, highest fidelity). Do not enable prevention on the Pastebin or generic outbound queries — both are FP-prone pivots.

No vetted atomic IOCs are public. The CSV uses REPLACE_WITH_… placeholders — fill from your own detonation or a trusted feed before importing as prevent.

type,value,action,severity,expiration,description,tags
sha256,REPLACE_WITH_SHA256,detect,high,2026-10-10,QuimaRAT JAR payload,malware:QuimaRAT
domain,REPLACE_WITH_C2,detect,high,2026-10-10,QuimaRAT C2,malware:QuimaRAT
ipv4,REPLACE_WITH_C2_IP,detect,high,2026-10-10,QuimaRAT C2,malware:QuimaRAT
domain,pastebin.com,hunt,low,2026-08-10,QuimaRAT C2-rotation channel (context-scope only),malware:QuimaRAT

Office / wscript / cscript / mshta spawning javaw.exe
javaw.exe -jar with a JAR in Temp / AppData / Downloads / ProgramData
Run key / Scheduled task / Startup entry invoking javaw -jar
config.dat (repeating-key XOR) written beside a JAR
.lock single-instance file in the OS temp directory (Java FileLock)
Java process resolving pastebin.com (C2-host rotation)
macOS LaunchAgent plist / Linux crontab @reboot / .desktop autostart launching java

Quima Control (the RAT) — 74 Windows / 46 macOS+Linux modules
Quima Builder — lure output: JAR/EXE/APP/SH/BAT/VBS/LNK/JS/DOCM/XLSM/CHM/MSC/CPL
Quima Loader — browser-cache payload delivery
Quima Dropper — HTML / SVG payload generator
C2 protocol messages: HANDSHAKE, HEARTBEAT (AES-256)

Windows: HKCU/HKLM ...\CurrentVersion\Run values invoking java -jar
Windows: scheduled tasks with a javaw -jar action; Startup .jar/.lnk
macOS:   ~/Library/LaunchAgents + /Library/LaunchAgents plists calling java
Linux:   crontab -l @reboot java ; ~/.config/autostart/*.desktop
All:     JAR + config.dat pair in a user-writable directory
Egress:  Java-context requests to pastebin.com raw paths

1 · Re-associate .jar away from the JRE (PowerShell, per-user)

# Point .jar at notepad on non-developer endpoints so lures don't auto-run in the JVM
cmd /c assoc .jar=jarfile
cmd /c ftype jarfile="%SystemRoot%\system32\notepad.exe" "%1"
# Reverse on developer machines that legitimately need java -jar.

2 · Enable Office ASR (block child process + executable content)

# Block all Office apps from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled
# Block executable content from email client and webmail
Add-MpPreference -AttackSurfaceReductionRules_Ids be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 -AttackSurfaceReductionRules_Actions Enabled

3 · Hunt Run-key Java persistence (PowerShell)

$paths = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
         'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
foreach ($p in $paths) {
  Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
    ForEach-Object { $_.PSObject.Properties } |
    Where-Object { $_.Value -match 'javaw?.*-jar' } |
    Select-Object Name, Value
}

4 · macOS LaunchAgent sweep (shell)

for d in ~/Library/LaunchAgents /Library/LaunchAgents; do
  grep -lri -e 'java' -e '\.jar' "$d" 2>/dev/null
done
# Review each hit; unload with: launchctl unload -w <plist> after triage.

Known gaps: atomic IOCs (hash/C2) are unpublished — Q8 is an FP-heavy pivot until you detonate and pin real infrastructure; on-host collection actions (credential/webcam/clipboard) are not distinguishable in process telemetry alone. Prioritize Q1–Q3, detonate a recovered sample to harden Q8, and validate Q3/Q5/Q7 field behavior in your tenant before promoting.