{
  "family": "joiner",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Trojan:Win32/Joiner (also known as a File Binder or Wrapper) is not a specific malware payload, but rather a **Malware Creation and Delivery Tool**. It is a utility used by attackers to combine (or 'join') two or more separate files into a single executable binary. Typically, an attacker uses a Joiner to bind a malicious payload (like a trojan or keylogger) to a legitimate, highly sought-after file (like a game installer, a PDF document, or a cracked software patch) to deceive the victim into executing the malware.<br><br><b>Understanding Joiners (File Binders)</b><br>To an end-user, the executed file appears exactly as expected—the game installs, or the PDF opens normally. They are completely unaware that a malicious process was simultaneously launched in the background. For a security analyst, a 'Joiner' detection indicates that social engineering and file spoofing are being used to bypass security controls and trick users into authorizing execution.<br><br><b>Execution and Binding Mechanics</b><br>The Joiner tool is used by the attacker prior to deployment. The attacker selects the 'carrier' file (e.g., `Install_Game.exe`) and the 'payload' file (e.g., `stealer.exe`). The Joiner program packages both files into a new, single executable (`T1027`). It often allows the attacker to spoof the file icon (e.g., making the `.exe` look like a `.pdf` icon) (`T1036.005`). When the victim executes the bound file (`T1204.002`), a small stub program runs first. This stub silently extracts both the legitimate carrier file and the hidden malware to a temporary directory (`%Temp%`). It then executes the malware invisibly in the background while simultaneously launching the legitimate program in the foreground, ensuring the victim suspects nothing.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the payload that was joined to the carrier file (e.g., ransomware, spyware). Host-based IoCs include EDR telemetry showing a supposedly legitimate installer suddenly dropping and executing a completely unrelated, unknown executable from the `%Temp%` directory. The presence of 'Double Extensions' (e.g., `document.pdf.exe`) is a classic sign of a joined file relying on social engineering.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027",
    "T1204.002",
    "T1036.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Binding files together)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location (Spoofing icons/extensions)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent the hidden payload (the malware that was joined to the carrier file) from executing its objectives or moving laterally.",
    "Analyze EDR telemetry to identify the child processes spawned by the initial execution; the true malware is often extracted to `%Temp%`.",
    "Extract the bound executable and analyze it in a sandbox to separate the carrier file from the malicious payload for detailed analysis.",
    "Run a full system scan to remove the extracted malware and any persistence mechanisms it may have established."
  ],
  "what_to_avoid": [
    "Do not assume a file is safe just because it successfully launched a legitimate application; the malware executes silently in the background.",
    "Avoid relying solely on file icons; Windows hides file extensions by default, making icon spoofing via Joiners highly effective."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}