Joiner

Overview

Trojan:Win32/Joiner (also known as a File Binder or Wrapper) is not a specific malware payload, but rather a **Malware Creation and Delivery Tool**. It is a utility used by attackers to combine (or 'join') two or more separate files into a single executable binary. Typically, an attacker uses a Joiner to bind a malicious payload (like a trojan or keylogger) to a legitimate, highly sought-after file (like a game installer, a PDF document, or a cracked software patch) to deceive the victim into executing the malware.

Understanding Joiners (File Binders)
To an end-user, the executed file appears exactly as expected—the game installs, or the PDF opens normally. They are completely unaware that a malicious process was simultaneously launched in the background. For a security analyst, a 'Joiner' detection indicates that social engineering and file spoofing are being used to bypass security controls and trick users into authorizing execution.

Execution and Binding Mechanics
The Joiner tool is used by the attacker prior to deployment. The attacker selects the 'carrier' file (e.g., `Install_Game.exe`) and the 'payload' file (e.g., `stealer.exe`). The Joiner program packages both files into a new, single executable (`T1027`). It often allows the attacker to spoof the file icon (e.g., making the `.exe` look like a `.pdf` icon) (`T1036.005`). When the victim executes the bound file (`T1204.002`), a small stub program runs first. This stub silently extracts both the legitimate carrier file and the hidden malware to a temporary directory (`%Temp%`). It then executes the malware invisibly in the background while simultaneously launching the legitimate program in the foreground, ensuring the victim suspects nothing.

Indicators of Compromise & Impact
The impact depends on the payload that was joined to the carrier file (e.g., ransomware, spyware). Host-based IoCs include EDR telemetry showing a supposedly legitimate installer suddenly dropping and executing a completely unrelated, unknown executable from the `%Temp%` directory. The presence of 'Double Extensions' (e.g., `document.pdf.exe`) is a classic sign of a joined file relying on social engineering.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.005: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_JOINER {
    meta:
        description = "Detects Joiner (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "joiner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Joiner Activity
id: b856b4dcfe88cedf7f616034d4485c33
status: experimental
description: Detects generic indicators of the joiner malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*joiner*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint to prevent the hidden payload (the malware that was joined to the carrier file) from executing its objectives or moving laterally.
2. Analyze EDR telemetry to identify the child processes spawned by the initial execution; the true malware is often extracted to `%Temp%`.
3. Extract the bound executable and analyze it in a sandbox to separate the carrier file from the malicious payload for detailed analysis.
4. Run a full system scan to remove the extracted malware and any persistence mechanisms it may have established.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume a file is safe just because it successfully launched a legitimate application; the malware executes silently in the background.
2. Avoid relying solely on file icons; Windows hides file extensions by default, making icon spoofing via Joiners highly effective.

References & External Analysis

• Search "joiner" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Crysis
• Ezoons
• Killapp
• Davobevix
• Pintu

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/joiner.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.