{
  "family": "qqlogger",
  "sample_count": 29,
  "category": "spyware",
  "description": "QQLogger (classified across threat research databases under signatures including Spyware:Win32/QQLogger, Trojan-Spy:Win32/QQLogger, and PWS:Win32/QQLogger) is a specialized credential stealer and spyware trojan active since 2008. Designed primarily to target Tencent QQ instant messaging clients, gaming portals, and online services popular in East Asia, QQLogger installs system-wide keyboard hooks (via SetWindowsHookEx) and memory scanning routines to intercept user account credentials. Upon execution, QQLogger monitors foreground windows, capturing usernames, passwords, and private chat messages when QQ login windows or web authentication forms are detected. The intercepted credentials are encrypted and exfiltrated over HTTP POST or direct SMTP mail messages to threat actor collection servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Spyware:Win32/QQLogger",
    "Trojan-Spy:Win32/QQLogger",
    "PWS:Win32/QQLogger",
    "Win32/QQLogger",
    "TrojanSpy:Win32/QQPass"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Spyware:Win32/QQLogger?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "QQLogger is a spyware and password-stealing trojan designed to intercept Tencent QQ accounts, passwords, and chat messages."
      }
    },
    {
      "@type": "Question",
      "name": "How does QQLogger steal account passwords?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs Windows keyboard hooks (SetWindowsHookEx) and scans process memory whenever a QQ login dialog is detected."
      }
    },
    {
      "@type": "Question",
      "name": "How does QQLogger exfiltrate stolen credentials?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It packages credentials into encrypted messages and transmits them via HTTP POST requests or SMTP email to the attacker."
      }
    },
    {
      "@type": "Question",
      "name": "How does QQLogger maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers autostart entries in the Windows CurrentVersion\\Run registry key and disguises its executable as a system helper."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken if infected with QQLogger?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately change Tencent QQ and associated gaming passwords from a clean device, enable two-factor authentication, and scan the system with Microsoft Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1555.003",
    "T1041",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2008,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Gaming Utilities & Patches",
    "Phishing Messages on Instant Messaging Networks",
    "Deceptive Chinese Software Repositories"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "Tencent QQ Login Credential Interception",
    "System-Wide Keystroke Logging (SetWindowsHookEx)",
    "Memory Scraping of Messaging Client Dialogs",
    "Encrypted SMTP / HTTP Data Exfiltration",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Hooking Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Direct SMTP traffic (TCP port 25 or 587) dispatching stolen credential logs formatted as email messages",
      "HTTP POST requests transmitting serialized credential strings to remote web drop scripts"
    ],
    "evasion_techniques": [
      "Injecting hook DLLs into explorer.exe to avoid running as a standalone visible process",
      "Naming the binary after legitimate Windows components like qqhelper.exe or winlogon_ex.exe"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7bf1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9",
      "8ca2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\QQLoggerSvc",
      "HKCU\\Software\\QQPass"
    ],
    "file_paths": [
      "%AppData%\\QQLogger\\qqlog.exe",
      "%Temp%\\qq_keys.dat",
      "%LocalAppdata%\\Temp\\pass_cache.tmp"
    ]
  },
  "defensive_measures": [
    "Enforce Multi-Factor Authentication (MFA) on all messaging and gaming accounts to neutralize password theft",
    "Deploy endpoint security that monitors for unauthorized global keyboard hooking (SetWindowsHookEx)",
    "Block outbound SMTP connections from user workstations at network perimeter firewalls"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Spyware:Win32/QQLogger",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Spyware:Win32/QQLogger"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - TrojanSpy.Win32.QQPass",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Spyware:Win32/QQLogger.A",
      "TrojanSpy:Win32/QQPass.gen"
    ]
  },
  "motivation": "Account Theft, Virtual Asset Monetization & Identity Hijacking",
  "sample_hashes": []
}