New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS

Source Domain: thehackernews.com

Cybersecurity researchers have flagged a novel Java-based remote access trojan (RAT) called QuimaRAT that’s capable of targeting Windows, Linux, and macOS environments.

According to LevelBlue, the cross-platform malware is advertised under a malware-as-a-service (MaaS) model, costing anywhere between $150 for one month to $1,200 for lifetime access. Other subscription tiers include $300 for three months, $500 for six months, and $700 for twelve months.

“Built around a modular architecture, the RAT supports dynamic capability expansion through encrypted plugins that can be delivered, loaded, unloaded, and updated directly from its command-and-control (C2) infrastructure,” the cybersecurity company said in an analysis of the malware.

The malware author also advertises a builder capable of generating multiple output formats, including JAR, EXE, APP, SH, BAT, and VBS, indicating an attempt to help prospective customers package the client tailored for different environments and delivery scenarios.

The seller’s post guarantees complete stealth on Windows and Linux, noting there are no visible user interface elements or desktop entries. On macOS, however, the threat actor includes a caveat that certain features like screen capture and input control require “user-granted admin permissions.”

Visiting their website, users are greeted by a pop-up message that states the platform “provides offensive security tooling intended exclusively for professional security research, authorized penetration testing, and controlled educational environments,” warning them against using it for “malicious, unauthorized, or illegal purposes.”

In all, the threat actor offers four tools –

Quima Control (aka QuimaRAT), a remote administration tool with 74 Windows and 46 macOS and Linux modules
Quima Builder, a modular builder and launcher toolkit with support for XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, and CHM file formats
Quima Loader, a browser-cache payload delivery…

Source