Executive Summary
Analysis reveals a multi-stage delivery mechanism for Quima RAT that utilizes highly obfuscated VBScript to bypass traditional sandbox and automated analysis environments. The loader is notable for its ability to dynamically detect the presence of a Java Runtime Environment (JRE) on the host and, if missing, automatically download and install legitimate OpenJDK distributions (Adoptium, Azul, or Corretto) to ensure successful execution of the primary JAR payload.
The attack chain begins with an initial execution delay followed by the extraction of an embedded, Base64-encoded JAR from the VBScript's own file body. It abuses built-in Windows components such as certutil.exe for decoding and ADODB.Stream for binary manipulation, significantly reducing its footprint. The final stage involves the silent execution of the Quima RAT JAR via javaw.exe, which contains the core networking and data exfiltration capabilities.
This threat highlights the continued trend of 'living-off-the-land' techniques combined with cross-platform languages like Java to maintain stealth. Organizations should be aware that the presence of legitimate Java utilities in unusual directories (e.g., %LOCALAPPDATA%) may indicate an ongoing compromise.