{
  "family": "uk_splitter",
  "sample_count": 0,
  "category": "trojan",
  "description": "UK Splitter (specifically known across security communities as UK Splitter 1.2 and HackTool.Win32.UKSplitter) is a specialized binary joiner, executable file binder, and malware dropper companion created circa 2003 by a hacker group known as 'UK-Crew'. Widely utilized in underground cybercrime circles, UK Splitter was designed to merge malicious backdoor servers (such as SubSeven, NetBus, or Optix Pro) with benign host programs (such as games, media players, or images). When the victim executes the bound carrier file, UK Splitter extracts and displays the legitimate decoy program in the foreground to eliminate suspicion, while simultaneously dropping and executing the malicious payload silently in the background. UK Splitter featured customizable executable icon replacement, stub compression, and automated autostart registry configuration to ensure persistent execution across system reboots.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "UK Splitter 1.2",
    "HackTool.Win32.UKSplitter",
    "Binder.UKSplitter",
    "UK Splitter Pro",
    "UK-Crew Splitter"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the UK Splitter tool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "UK Splitter is an executable file binder and joiner designed to combine malicious backdoors with benign decoy programs."
      }
    },
    {
      "@type": "Question",
      "name": "Who developed UK Splitter?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was developed around 2003 by a programming group known as 'UK-Crew' and circulated on underground hacking sites."
      }
    },
    {
      "@type": "Question",
      "name": "How does UK Splitter deceive victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It launches a benign decoy game, image, or utility in the foreground while silently executing the hidden trojan payload in the background."
      }
    },
    {
      "@type": "Question",
      "name": "What customization options did UK Splitter offer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allowed attackers to customize executable icons, configure silent extraction paths, and inject autostart registry entries."
      }
    },
    {
      "@type": "Question",
      "name": "How can bound UK Splitter files be detected?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Use endpoint static file inspection to detect merged binary resources, abnormal PE sections, and unauthorized dropped executables in %TEMP%."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2003,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Win32 Binary Joiners and Droppers"
    ],
    "variants": [
      "UK Splitter 1.0",
      "UK Splitter 1.2",
      "UK Splitter Pro"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1027.002",
    "T1036.005",
    "T1105",
    "T1059.003",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Terminate both the decoy application and the secondary dropped payload executing from %TEMP% or %APPDATA%.",
    "Delete the extracted malicious binaries and bound carrier executables.",
    "Remove startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run created by the dropped payload.",
    "Run a full antimalware scan to ensure no additional payloads were dropped onto the system."
  ],
  "what_to_avoid": [
    "Do not execute software files downloaded from unverified forums, P2P networks, or file sharing sites.",
    "Avoid bypassing operating system executable signing checks when opening third-party files."
  ],
  "iocs": {
    "file_hashes": [
      "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2",
      "5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a"
    ],
    "delivery": [
      "Trojanized freeware software downloads and pirated game archives distributed via P2P",
      "Email attachments disguised as legitimate multimedia files or PDF documents"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\UKSplitterStub",
      "%TEMP%\\dropped_server.exe"
    ]
  },
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - HackTool.Win32.UKSplitter",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/hacktool.win32.uksplitter"
    },
    {
      "name": "Malware Museum Historical Binder Collection - UK Splitter",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}