Cybersecurity researchers have identified QuimaRAT, a Java-based remote access trojan sold as malware-as-a-service for Windows, Linux and macOS, with subscription prices ranging from $150 for one month to $1,200 for lifetime access.
KEY FACTS
- Platforms The malware targets Windows, Linux and macOS.
- Pricing The service is advertised from $150 monthly to $1,200 for lifetime use.
- Capabilities The toolset includes a RAT, builder, loader and dropper.
- Delivery The loader can stage payloads through browser cache and use lures such as fake CAPTCHA checks.
- Persistence The malware uses OS-specific startup and scheduled task methods.
A technical analysis from LevelBlue said the malware is built as a modular Java project and uses encrypted plugins that can be loaded and updated from command-and-control infrastructure. The report said the seller offers multiple build formats, including JAR, EXE, APP, SH, BAT and VBS.
The disclosure said QuimaRAT includes 74 Windows modules and 46 macOS and Linux modules. It also said the malware can create a lock file to keep only one instance running on a system and can check the operating system before deciding how to proceed.
LevelBlue said the trojan can establish persistence using Registry Run keys, Scheduled tasks, the Windows Startup folder, .desktop autostart entries, crontab reboot tasks and a LaunchAgent plist file. It also supports remote command execution, credential theft, file transfer, clipboard manipulation and webcam surveillance.
The report said the malware can communicate with its operators over TCP, WebSocket, TLS or HTTPS, and includes a watchdog component that tries to reconnect if the channel drops. It also described an optional Pastebin-based update mechanism for changing command-and-control hosts without rebuilding the payload.
WHY IT MATTERS
The findings show how commercial malware kits are being packaged for multiple operating systems and delivery paths, which can widen the number of potential victims. The cross-platform design and modular structure can also make detection and response more difficult for defenders.