Joiner

Overview

Trojan:Win32/Joiner (also known as a File Binder or Wrapper) is not a specific malware payload, but rather a **Malware Creation and Delivery Tool**. It is a utility used by attackers to combine (or 'join') two or more separate files into a single executable binary. Typically, an attacker uses a Joiner to bind a malicious payload (like a trojan or keylogger) to a legitimate, highly sought-after file (like a game installer, a PDF document, or a cracked software patch) to deceive the victim into executing the malware.

Understanding Joiners (File Binders)
To an end-user, the executed file appears exactly as expected—the game installs, or the PDF opens normally. They are completely unaware that a malicious process was simultaneously launched in the background. For a security analyst, a 'Joiner' detection indicates that social engineering and file spoofing are being used to bypass security controls and trick users into authorizing execution.

Execution and Binding Mechanics
The Joiner tool is used by the attacker prior to deployment. The attacker selects the 'carrier' file (e.g., `Install_Game.exe`) and the 'payload' file (e.g., `stealer.exe`). The Joiner program packages both files into a new, single executable (`T1027`). It often allows the attacker to spoof the file icon (e.g., making the `.exe` look like a `.pdf` icon) (`T1036.005`). When the victim executes the bound file (`T1204.002`), a small stub program runs first. This stub silently extracts both the legitimate carrier file and the hidden malware to a temporary directory (`%Temp%`). It then executes the malware invisibly in the background while simultaneously launching the legitimate program in the foreground, ensuring the victim suspects nothing.

Indicators of Compromise & Impact
The impact depends on the payload that was joined to the carrier file (e.g., ransomware, spyware). Host-based IoCs include EDR telemetry showing a supposedly legitimate installer suddenly dropping and executing a completely unrelated, unknown executable from the `%Temp%` directory. The presence of 'Double Extensions' (e.g., `document.pdf.exe`) is a classic sign of a joined file relying on social engineering.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.005: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_JOINER_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Joiner"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "joiner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Joiner (Ransomware) Execution & Triage
id: f019abf7-e446-5a5c-bc38-a7f8db92d9aa
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Joiner malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/joiner
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1027
- attack.t1204_002
- attack.t1036_005
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_JOINER_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Joiner tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "joiner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint to prevent the hidden payload (the malware that was joined to the carrier file) from executing its objectives or moving laterally.
2. Analyze EDR telemetry to identify the child processes spawned by the initial execution; the true malware is often extracted to `%Temp%`.
3. Extract the bound executable and analyze it in a sandbox to separate the carrier file from the malicious payload for detailed analysis.
4. Run a full system scan to remove the extracted malware and any persistence mechanisms it may have established.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume a file is safe just because it successfully launched a legitimate application; the malware executes silently in the background.
2. Avoid relying solely on file icons; Windows hides file extensions by default, making icon spoofing via Joiners highly effective.

References & External Analysis

• Search "joiner" on VirusTotal (External Analysis)
• Search "joiner" on Any.Run (Sandbox Sandbox)
• Search "joiner" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Bhosta
• Genericrxfv
• Sanctionedmedia
• Kryptpck
• Emmfaeuirscb
• Systex
• Loops
• Tinydl

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/joiner.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.