Qqlogger

Overview

TrojanSpy:Win32/Qqlogger is a specialized, targeted keylogger and credential stealer designed specifically to harvest authentication tokens, chat logs, and keystrokes from users of the Tencent QQ instant messaging platform, which is massively popular in China and throughout Asia.

Understanding Qqlogger
To the victim, Qqlogger operates invisibly. Their QQ application functions normally, but behind the scenes, their communications and credentials are being siphoned. For a security analyst, Qqlogger represents a highly targeted espionage tool. Unlike generic keyloggers that capture all system keystrokes (which creates a massive amount of noisy data for the attacker to parse), Qqlogger specifically hooks into the QQ process memory space or window handles to extract high-value target data cleanly.

Execution and Exfiltration Strategies
Qqlogger is typically distributed via targeted spearphishing campaigns (often using weaponized Office documents) or dropped by other initial access Trojans. Upon execution, it achieves persistence (`T1547.001`) via Registry modifications. It then employs API hooking (`T1056.001`)—often intercepting calls like `GetMessage` or `GetAsyncKeyState`—specifically when the foreground window title matches the QQ application. Advanced variants perform process injection (`T1055`) directly into the `QQ.exe` process to steal session tokens directly from memory, bypassing the need to log keystrokes entirely. The stolen data is usually exfiltrated via SMTP (email) or direct HTTP POST requests to a drop server.

Indicators of Compromise & Impact
The primary impact is the total compromise of the victim's social and professional QQ communications, which can be leveraged for further phishing, blackmail, or corporate espionage. EDR tools should flag unauthorized process injection into `QQ.exe`. Network logs may reveal the malware communicating with unknown SMTP servers to exfiltrate the logged data (`T1048`).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_QQLOGGER {
    meta:
        description = "Detects Qqlogger (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "qqlogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Qqlogger Activity
id: 07df5fb84a93c2186151281615a43f04
status: experimental
description: Detects generic indicators of the qqlogger malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*qqlogger*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to halt the exfiltration of sensitive QQ chat logs and credentials.
2. Force an immediate password reset and invalidate all active session tokens for the compromised QQ account.
3. Use EDR or memory forensics to identify the malicious process hooking the QQ application and terminate it.
4. Audit firewall logs for unauthorized SMTP or HTTP POST traffic originating from the infected endpoint.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume only QQ was compromised; while it targets QQ, the initial vector may have dropped other malware.
2. Avoid letting the user log back into QQ on the infected machine until it is fully rebuilt.

References & External Analysis

• Search "qqlogger" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Mmnfbgfpueki
• Shelma
• Evital
• Look2Me
• Xxybwe

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/qqlogger.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.