{
  "family": "joiner",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Trojan:Win32/Joiner (also known as a File Binder or Wrapper) is not a specific malware payload, but rather a **Malware Creation and Delivery Tool**. It is a utility used by attackers to combine (or 'join') two or more separate files into a single executable binary. Typically, an attacker uses a Joiner to bind a malicious payload (like a trojan or keylogger) to a legitimate, highly sought-after file (like a game installer, a PDF document, or a cracked software patch) to deceive the victim into executing the malware.<br><br><b>Understanding Joiners (File Binders)</b><br>To an end-user, the executed file appears exactly as expected—the game installs, or the PDF opens normally. They are completely unaware that a malicious process was simultaneously launched in the background. For a security analyst, a 'Joiner' detection indicates that social engineering and file spoofing are being used to bypass security controls and trick users into authorizing execution.<br><br><b>Execution and Binding Mechanics</b><br>The Joiner tool is used by the attacker prior to deployment. The attacker selects the 'carrier' file (e.g., `Install_Game.exe`) and the 'payload' file (e.g., `stealer.exe`). The Joiner program packages both files into a new, single executable (`T1027`). It often allows the attacker to spoof the file icon (e.g., making the `.exe` look like a `.pdf` icon) (`T1036.005`). When the victim executes the bound file (`T1204.002`), a small stub program runs first. This stub silently extracts both the legitimate carrier file and the hidden malware to a temporary directory (`%Temp%`). It then executes the malware invisibly in the background while simultaneously launching the legitimate program in the foreground, ensuring the victim suspects nothing.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the payload that was joined to the carrier file (e.g., ransomware, spyware). Host-based IoCs include EDR telemetry showing a supposedly legitimate installer suddenly dropping and executing a completely unrelated, unknown executable from the `%Temp%` directory. The presence of 'Double Extensions' (e.g., `document.pdf.exe`) is a classic sign of a joined file relying on social engineering.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Joiner and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Joiner is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Joiner establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Joiner typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Joiner compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Joiner should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Joiner employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Joiner typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Joiner, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Joiner depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1204.002",
    "T1036.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Binding files together)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location (Spoofing icons/extensions)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent the hidden payload (the malware that was joined to the carrier file) from executing its objectives or moving laterally.",
    "Analyze EDR telemetry to identify the child processes spawned by the initial execution; the true malware is often extracted to `%Temp%`.",
    "Extract the bound executable and analyze it in a sandbox to separate the carrier file from the malicious payload for detailed analysis.",
    "Run a full system scan to remove the extracted malware and any persistence mechanisms it may have established."
  ],
  "what_to_avoid": [
    "Do not assume a file is safe just because it successfully launched a legitimate application; the malware executes silently in the background.",
    "Avoid relying solely on file icons; Windows hides file extensions by default, making icon spoofing via Joiners highly effective."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}