{
  "family": "qqlogger",
  "sample_count": 29,
  "category": "trojan",
  "description": "TrojanSpy:Win32/Qqlogger is a specialized, targeted keylogger and credential stealer designed specifically to harvest authentication tokens, chat logs, and keystrokes from users of the Tencent QQ instant messaging platform, which is massively popular in China and throughout Asia.<br><br><b>Understanding Qqlogger</b><br>To the victim, Qqlogger operates invisibly. Their QQ application functions normally, but behind the scenes, their communications and credentials are being siphoned. For a security analyst, Qqlogger represents a highly targeted espionage tool. Unlike generic keyloggers that capture all system keystrokes (which creates a massive amount of noisy data for the attacker to parse), Qqlogger specifically hooks into the QQ process memory space or window handles to extract high-value target data cleanly.<br><br><b>Execution and Exfiltration Strategies</b><br>Qqlogger is typically distributed via targeted spearphishing campaigns (often using weaponized Office documents) or dropped by other initial access Trojans. Upon execution, it achieves persistence (`T1547.001`) via Registry modifications. It then employs API hooking (`T1056.001`)—often intercepting calls like `GetMessage` or `GetAsyncKeyState`—specifically when the foreground window title matches the QQ application. Advanced variants perform process injection (`T1055`) directly into the `QQ.exe` process to steal session tokens directly from memory, bypassing the need to log keystrokes entirely. The stolen data is usually exfiltrated via SMTP (email) or direct HTTP POST requests to a drop server.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total compromise of the victim's social and professional QQ communications, which can be leveraged for further phishing, blackmail, or corporate espionage. EDR tools should flag unauthorized process injection into `QQ.exe`. Network logs may reveal the malware communicating with unknown SMTP servers to exfiltrate the logged data (`T1048`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1547.001",
    "T1055",
    "T1048",
    "T1552.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1552.001",
      "name": "Unsecured Credentials: Credentials In Files",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the exfiltration of sensitive QQ chat logs and credentials.",
    "Force an immediate password reset and invalidate all active session tokens for the compromised QQ account.",
    "Use EDR or memory forensics to identify the malicious process hooking the QQ application and terminate it.",
    "Audit firewall logs for unauthorized SMTP or HTTP POST traffic originating from the infected endpoint."
  ],
  "what_to_avoid": [
    "Do not assume only QQ was compromised; while it targets QQ, the initial vector may have dropped other malware.",
    "Avoid letting the user log back into QQ on the infected machine until it is fully rebuilt."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}