Malware

QuimaRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

5 techniques

T1053Scheduled Task/JobEvidence1

The malware sets up persistence using a variety of operating system-specific methods: Registry Run keys, Scheduled tasks, and the Startup folder for Windows, .desktop autostart entries and crontab reboot tasks for Linux...

T1059Command and Scripting InterpreterEvidence1

The malware supports a wide range of capabilities, including remote command execution...

T1106Native APIEvidence1

These native components allow the RAT to interact directly with low-level operating system APIs through C/C++ code, indicating intentional support for broad multi-platform deployment.

T1129Shared ModulesEvidence1

Built around a modular architecture, the RAT supports dynamic capability expansion through encrypted plugins that can be delivered, loaded, unloaded, and updated directly from its command-and-control (C2) infrastructure.

T1204.002Malicious FileEvidence1

A Download button appears on the page. Clicking it saves a 'small, clean loader file' that's trusted by the browser. Target runs the loader, which reads the cached payload. The main payload gets executed on the system...

Persistence

3 techniques

T1053Scheduled Task/JobEvidence1

T1543.001Launch AgentEvidence1

The malware sets up persistence using a variety of operating system-specific methods: ... and a LaunchAgent plist file for macOS.

T1547.001Registry Run Keys / Startup FolderEvidence1

The malware sets up persistence using a variety of operating system-specific methods: Registry Run keys, Scheduled tasks, and the Startup folder for Windows...

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

T1543.001Launch AgentEvidence1

The malware sets up persistence using a variety of operating system-specific methods: ... and a LaunchAgent plist file for macOS.

T1547.001Registry Run Keys / Startup FolderEvidence1

The malware sets up persistence using a variety of operating system-specific methods: Registry Run keys, Scheduled tasks, and the Startup folder for Windows...

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

ProGuard-class obfuscation indicators, Maven Shade relocation, preserved runtime symbols, and synthetic string decryptors further support the assessment that QuimaRAT is designed to rotate static fingerprints without changing its core behavior.

T1027.011Fileless StorageEvidence1

Quima Loader ... allows an operator to upload an EXE file ... The landing page is loaded, and the payload is fetched and held in the browser cache.

T1218System Binary Proxy ExecutionEvidence1

The author behind the Quima suite claims on their website. 'Native execution paths, system-owned resources, clean outputs.' | The main payload gets executed on the system, while bypassing SmartScreen protections on Windows.

T1497Virtualization/Sandbox EvasionEvidence1

QuimaRAT is designed to determine the current operating system name, using it to dictate the next course of action, including evading sandboxed and virtual environments, establishing persistence, and serving the main payload.

T1497.001System ChecksEvidence1

QuimaRAT is designed to determine the current operating system name, using it to dictate the next course of action...

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

The malware supports a wide range of capabilities, including remote command execution, remote payload and plugin delivery, credential theft...

Discovery

3 techniques

T1083File and Directory DiscoveryEvidence1

The malware supports a wide range of capabilities, including remote command execution, remote payload and plugin delivery, credential theft, persistence, file transfer, clipboard manipulation, and webcam surveillance...

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

QuimaRAT is designed to determine the current operating system name, using it to dictate the next course of action...

Collection

2 techniques

T1115Clipboard DataEvidence1

The malware supports a wide range of capabilities, including ... clipboard manipulation...

T1125Video CaptureEvidence1

The malware supports a wide range of capabilities, including ... webcam surveillance...

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The end goal of the QuimaRAT is to establish communication with the C2 server over TCP (or alternately via WebSocket, TLS, and HTTPS) to receive and execute commands.

T1105Ingress Tool TransferEvidence1

The malware supports a wide range of capabilities, including remote command execution, remote payload and plugin delivery...

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

the hacker newsNews

Jul 6, 2026

New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS

A novel cross-platform Java-based remote access trojan sold under a malware-as-a-service model. It uses a modular architecture with encrypted plugins, supports persistence across Windows/Linux/macOS, communicates with C2 over TCP/WebSocket/TLS/HTTPS, can rotate C2 via Pastebin, and provides capabilities including remote command execution, payload/plugin delivery, credential theft, file transfer, clipboard manipulation, webcam surveillance, and fileless shellcode execution on Windows.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

QuimaRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

5 techniques

T1053Scheduled Task/JobEvidence1

T1059Command and Scripting InterpreterEvidence1

The malware supports a wide range of capabilities, including remote command execution...

T1106Native APIEvidence1

These native components allow the RAT to interact directly with low-level operating system APIs through C/C++ code, indicating intentional support for broad multi-platform deployment.

T1129Shared ModulesEvidence1

T1204.002Malicious FileEvidence1

Persistence

3 techniques

T1053Scheduled Task/JobEvidence1

T1543.001Launch AgentEvidence1

The malware sets up persistence using a variety of operating system-specific methods: ... and a LaunchAgent plist file for macOS.

T1547.001Registry Run Keys / Startup FolderEvidence1

The malware sets up persistence using a variety of operating system-specific methods: Registry Run keys, Scheduled tasks, and the Startup folder for Windows...

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

T1543.001Launch AgentEvidence1

The malware sets up persistence using a variety of operating system-specific methods: ... and a LaunchAgent plist file for macOS.

T1547.001Registry Run Keys / Startup FolderEvidence1

The malware sets up persistence using a variety of operating system-specific methods: Registry Run keys, Scheduled tasks, and the Startup folder for Windows...

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

T1027.011Fileless StorageEvidence1

Quima Loader ... allows an operator to upload an EXE file ... The landing page is loaded, and the payload is fetched and held in the browser cache.

T1218System Binary Proxy ExecutionEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

QuimaRAT is designed to determine the current operating system name, using it to dictate the next course of action...

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

The malware supports a wide range of capabilities, including remote command execution, remote payload and plugin delivery, credential theft...

Discovery

3 techniques

T1083File and Directory DiscoveryEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

QuimaRAT is designed to determine the current operating system name, using it to dictate the next course of action...

Collection

2 techniques

T1115Clipboard DataEvidence1

The malware supports a wide range of capabilities, including ... clipboard manipulation...

T1125Video CaptureEvidence1

The malware supports a wide range of capabilities, including ... webcam surveillance...

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The end goal of the QuimaRAT is to establish communication with the C2 server over TCP (or alternately via WebSocket, TLS, and HTTPS) to receive and execute commands.

T1105Ingress Tool TransferEvidence1

The malware supports a wide range of capabilities, including remote command execution, remote payload and plugin delivery...

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

the hacker newsNews

Jul 6, 2026

New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.