{
  "family": "binder",
  "sample_count": 87,
  "category": "hacktool",
  "description": "Binder (cataloged across cybersecurity vendors under detections including HackTool:Win32/Binder, Trojan:Win32/Binder, and Win32/Binder) is a broad classification for malicious file joiner and binder utility frameworks active since 2005. Engineered to merge two or more independent files into a single compiled executable wrapper stub, Binder utilities are widely abused by threat actors to disguise malicious payloads inside seemingly harmless carrier programs (such as games, software installers, screen savers, or multimedia documents). When a victim launches the bound binary, the wrapper silently extracts the decoy application to %Temp% and executes it in the foreground to eliminate suspicion, while simultaneously unpacking, executing, and persisting the concealed secondary payload—such as a remote access trojan (RAT), infostealer, keylogger, or cryptominer—in the background without user interaction.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/Binder",
    "Trojan:Win32/Binder",
    "Win32/Binder",
    "FileBinder"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HackTool:Win32/Binder?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Binder is a hacktool classification for programs that combine legitimate decoy files with hidden malware into a single executable."
      }
    },
    {
      "@type": "Question",
      "name": "How do attackers use file binders in social engineering attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They bind malicious payloads with working tools or games, so the user sees normal behavior while malware installs silently."
      }
    },
    {
      "@type": "Question",
      "name": "Which secondary threats are commonly packed with binders?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remote Access Trojans (RATs), info-stealers, keyloggers, and initial access droppers are frequently distributed via binders."
      }
    },
    {
      "@type": "Question",
      "name": "Where do users typically encounter bound malicious files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "On pirated software portals, keygen download sites, gaming cheat forums, and deceptive torrent networks."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders identify and mitigate binder executables?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy endpoint behavioral monitoring, inspect binary overlay sections, block untrusted unsigned executables, and run deep antimalware scans."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1036.002",
    "T1204.002",
    "T1059.003",
    "T1105",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1036.002",
      "name": "Masquerading: Right-to-Left Override",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.004",
      "name": "Masquerading: Keep Original File Name",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the initial executable to prevent it from dropping and launching the hidden malicious payloads.",
    "Clear the Windows `%Temp%` directory, as file binders overwhelmingly use this location to extract and stage their hidden components.",
    "Utilize EDR to identify and terminate any child processes spawned by the initial executed file (excluding the legitimate decoy application).",
    "Perform a full system sweep to identify the specific malware family that was dropped by the binder."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is safe simply because the user saw the expected document; the malware executed silently in the background.",
    "Avoid ignoring the delivery vector; if a bound file arrived via email, a spearphishing campaign is actively targeting the organization."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Evasion & Defense Impairment",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2005,
  "threat_actor": null,
  "delivery_mechanism": [
    "Pirated Software & Cracks",
    "Trojanized Game Mods / Trainers",
    "Social Engineering Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Dual-File Extraction & Execution",
    "Foreground Decoy Launch",
    "Silent Background Malware Drop",
    "Binary Packaging & Compression",
    "Icon Masquerading"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Self-Extracting Stub"
    ],
    "network_signatures": [
      "Outbound C2 traffic initiated by dropped secondary payload following extraction"
    ],
    "evasion_techniques": [
      "Decoy program distraction suppressing user suspicion",
      "Resource section encryption of embedded binary payloads"
    ],
    "persistence_mechanisms": [
      "Delegated to the extracted secondary payload (Registry Run keys, Scheduled Tasks)"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Endpoint compromise, masquerading detection bypass, deceptive payload execution"
  },
  "lineage": {
    "derived_from": [
      "Classic Windows PE File Binders"
    ],
    "variants": [
      "Binder.Stub",
      "Joiner.Win32"
    ]
  },
  "iocs": {
    "file_hashes": [
      "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c",
      "8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a"
    ],
    "delivery": [
      "installer_bundle.exe",
      "game_trainer_crack.exe"
    ],
    "persistence": [
      "%Temp%\\decoy_app.exe",
      "%AppData%\\payload_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "Huntress Threat Research - Understanding File Binders and Joiners",
      "url": "https://www.huntress.com/blog"
    },
    {
      "name": "Microsoft Defender Security Intelligence - HackTool:Win32/Binder",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/Binder"
    }
  ]
}