{
  "family": "findkeyxp",
  "sample_count": 1,
  "category": "trojan",
  "description": "Trojan:Win32/Findkeyxp is a specialized InfoStealer whose primary objective is to locate, extract, and exfiltrate software license keys and product activation codes stored on the infected Windows system (`T1552.001`). Unlike broad-spectrum stealers that target browsers, Findkeyxp specifically hunts for valuable software assets that the attacker can resell.<br><br><b>Understanding Findkeyxp (License Stealers)</b><br>To an end-user, the infection is entirely invisible. Their software will continue to run normally. However, for a business, Findkeyxp represents a direct financial loss. The stolen license keys for expensive CAD software, enterprise databases, or even the Windows OS itself are aggregated and sold on underground forums or grey-market key reseller sites.<br><br><b>Execution and Extraction Mechanics</b><br>Findkeyxp is often distributed via 'cracked' software bundles or malspam. Upon execution, it does not typically establish long-term persistence, as it only needs to run once to steal the existing keys. It aggressively scans the Windows Registry (specifically querying `HKLM\\Software` and `HKCU\\Software`) (`T1012`) looking for known patterns associated with software licenses (e.g., 'ProductKey', 'Serial', 'License'). It also scans the file system for license files (`.lic`, `.key`). Once aggregated, this data is encrypted and exfiltrated to the attacker's C2 server (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is intellectual property theft and the unauthorized use of corporate software licenses by third parties. Host-based IoCs include EDR alerts for anomalous, rapid querying of thousands of registry keys by an unknown executable, and the execution of suspicious binaries from `%Temp%` or `%Downloads%`. Network IoCs include a brief burst of outbound HTTP POST traffic (exfiltrating the keys) immediately following the execution of the untrusted file.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Findkeyxp and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Findkeyxp is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Findkeyxp establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Findkeyxp typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Findkeyxp compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Findkeyxp should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Findkeyxp?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Findkeyxp frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Findkeyxp across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Findkeyxp by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1012",
    "T1552.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1552.001",
      "name": "Credentials In Files (Stealing software license files and activation keys)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1012",
      "name": "Query Registry (Scanning for stored Product Keys in the Windows Registry)",
      "tactic": "Discovery"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Sending the stolen keys to the attacker's server)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent further data exfiltration, though the keys are likely already stolen if the process completed.",
    "Audit the machine to determine exactly what software was installed; if expensive enterprise licenses were stolen, you may need to contact the vendor to invalidate those specific keys.",
    "Run a full anti-malware scan to remove the Findkeyxp executable and any other malware that was likely bundled with it.",
    "Implement Application Control (AppLocker) to prevent the execution of untrusted 'keygen' or 'crack' utilities, which are the primary vector for this threat."
  ],
  "what_to_avoid": [
    "Do not assume the threat is minor; stolen enterprise licenses can be used by attackers to set up malicious infrastructure that traces back to your company.",
    "Avoid downloading software from unofficial sources or P2P networks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}