Findkeyxp

Overview

Trojan:Win32/Findkeyxp is a specialized InfoStealer whose primary objective is to locate, extract, and exfiltrate software license keys and product activation codes stored on the infected Windows system (`T1552.001`). Unlike broad-spectrum stealers that target browsers, Findkeyxp specifically hunts for valuable software assets that the attacker can resell.

Understanding Findkeyxp (License Stealers)
To an end-user, the infection is entirely invisible. Their software will continue to run normally. However, for a business, Findkeyxp represents a direct financial loss. The stolen license keys for expensive CAD software, enterprise databases, or even the Windows OS itself are aggregated and sold on underground forums or grey-market key reseller sites.

Execution and Extraction Mechanics
Findkeyxp is often distributed via 'cracked' software bundles or malspam. Upon execution, it does not typically establish long-term persistence, as it only needs to run once to steal the existing keys. It aggressively scans the Windows Registry (specifically querying `HKLM\Software` and `HKCU\Software`) (`T1012`) looking for known patterns associated with software licenses (e.g., 'ProductKey', 'Serial', 'License'). It also scans the file system for license files (`.lic`, `.key`). Once aggregated, this data is encrypted and exfiltrated to the attacker's C2 server (`T1041`).

Indicators of Compromise & Impact
The impact is intellectual property theft and the unauthorized use of corporate software licenses by third parties. Host-based IoCs include EDR alerts for anomalous, rapid querying of thousands of registry keys by an unknown executable, and the execution of suspicious binaries from `%Temp%` or `%Downloads%`. Network IoCs include a brief burst of outbound HTTP POST traffic (exfiltrating the keys) immediately following the execution of the untrusted file.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FINDKEYXP {
    meta:
        description = "Detects Findkeyxp (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "findkeyxp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Findkeyxp Activity
id: 0281a8389df9e260a4278561f719dcc3
status: experimental
description: Detects generic indicators of the findkeyxp malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*findkeyxp*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint to prevent further data exfiltration, though the keys are likely already stolen if the process completed.
2. Audit the machine to determine exactly what software was installed; if expensive enterprise licenses were stolen, you may need to contact the vendor to invalidate those specific keys.
3. Run a full anti-malware scan to remove the Findkeyxp executable and any other malware that was likely bundled with it.
4. Implement Application Control (AppLocker) to prevent the execution of untrusted 'keygen' or 'crack' utilities, which are the primary vector for this threat.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the threat is minor; stolen enterprise licenses can be used by attackers to set up malicious infrastructure that traces back to your company.
2. Avoid downloading software from unofficial sources or P2P networks.

References & External Analysis

• Search "findkeyxp" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Hpursnif
• Tsklnk
• Attack
• Nivdort
• Plinch

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/findkeyxp.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.