Categories: PUA

What is “QQHelper (PUA)”?

The QQHelper (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What QQHelper (PUA) virus can do?

Creates RWX memory
Reads data out of its own binary image
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Attempts to modify proxy settings
Generates some ICMP traffic
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

check.ptlogin2.qq.com

ad.qqfarmer.com.cn

bakad.qqfarmer.com.cn

inf.qqfarmer.com.cn

inf.qqhaoniu.com

How to determine QQHelper (PUA)?


File Info:
crc32: D857AB24md5: 4e656769313f3eb9200505d042921161name: 4E656769313F3EB9200505D042921161.mlwsha1: dbd7930a2c52b9fb71a1c8098114ce322a93a5f2sha256: 2661e0eea43dc73c86c5e5366eada2164cf91e6b12a1e408dc0395f6d6dd7ad6sha512: b5485d5071717422a4350d4977b42789bc7cbdf6dbc8f6dad24eb7f4c3ee83c65038eac9090aa461c0fabcd20d76a6bea035aaedd7bd7d638f4e512b29876ce5ssdeep: 98304:fv3JgSBHNZ1hKLVG7Rd/X8EVZgzPHQT/:HuST8LubjkHQTtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: www.QQHelper.netInternalName: QQHelper.exeFileVersion: 1.3.4.1218CompanyName: www.QQHelper.netLegalTrademarks: www.QQHelper.netProductName: QQx519cx7267x9910x4e09x5408x4e00x52a9x624bProductVersion: 1.0.0.0FileDescription: QQx519cx7267x9910x4e09x5408x4e00x52a9x624bOriginalFilename: QQHelper.exeTranslation: 0x0804 0x03a8

QQHelper (PUA) also known as:

Lionic	Trojan.Win32.Ursu.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader26.35652
Cynet	Malicious (score: 100)
Cylance	Unsafe
APEX	Malicious
Avast	Win32:Malware-gen
Sophos	QQHelper (PUA)
McAfee-GW-Edition	BehavesLike.Win32.PUP.rh
FireEye	Generic.mg.4e656769313f3eb9
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_100%
Microsoft	Trojan:Win32/Occamy.C
AhnLab-V3	Unwanted/Win32.HackTool.R119402
McAfee	Artemis!4E656769313F
MAX	malware (ai score=99)
Malwarebytes	Adware.QQHelper
Yandex	Trojan.DownLoader!odTuYFLFzeg
Ikarus	Trojan.Graftor
AVG	Win32:Malware-gen
Paloalto	generic.ml