{
  "family": "binder",
  "sample_count": 87,
  "category": "ransomware",
  "description": "VirTool:Win32/Binder is a critical heuristic detection for files created by 'file binder' or 'joiner' utilities—tools explicitly designed to merge a malicious executable (like a trojan) with a harmless, legitimate file (like a PDF or installer) into a single executable, facilitating social engineering and defense evasion.<br><br><b>Understanding Binder</b><br>For the end-user, they believe they are opening a standard document or installing a known game. For a security analyst, a Binder detection highlights a direct attempt at social engineering. Attackers use binder tools to hide their malware in plain sight. When the victim double-clicks the bound file, the tool silently extracts and executes the hidden malware in the background, while simultaneously opening the legitimate document or installer in the foreground to avoid arousing suspicion.<br><br><b>Execution and Threat Hunting</b><br>File binders are commonly used in spearphishing campaigns or distributed via P2P networks. The attacker selects a decoy file (e.g., `Financial_Report.pdf`) and a payload (e.g., `rat.exe`). The binder combines them into `Financial_Report.exe` (often using an icon that mimics a PDF). Upon execution, the binder's stub code drops both files into the `%Temp%` directory. It uses the `ShellExecute` API to open the decoy PDF in the default viewer (satisfying the user), and then executes `rat.exe` silently. Threat hunters should investigate EDR alerts for 'Suspicious File Dropping' from seemingly innocuous applications.<br><br><b>Forensic Analysis & Impact</b><br>The impact depends on the hidden payload (which could be anything from adware to ransomware). Incident responders will observe a single executable dropping and launching multiple disparate processes. EDR logs will show the initial execution (the binder), immediately followed by the spawning of a legitimate application (like Adobe Reader) alongside an unknown, unsigned binary executing from the Temp directory.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027",
    "T1036.004",
    "T1204.002",
    "T1036.002",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1036.002",
      "name": "Masquerading: Right-to-Left Override",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.004",
      "name": "Masquerading: Keep Original File Name",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the initial executable to prevent it from dropping and launching the hidden malicious payloads.",
    "Clear the Windows `%Temp%` directory, as file binders overwhelmingly use this location to extract and stage their hidden components.",
    "Utilize EDR to identify and terminate any child processes spawned by the initial executed file (excluding the legitimate decoy application).",
    "Perform a full system sweep to identify the specific malware family that was dropped by the binder."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is safe simply because the user saw the expected document; the malware executed silently in the background.",
    "Avoid ignoring the delivery vector; if a bound file arrived via email, a spearphishing campaign is actively targeting the organization."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}