Ljoiner

Overview

HackTool:Win32/Ljoiner is a heuristic detection for utilities known as 'File Binders' or 'Joiners'. These are specialized tools used by malware authors to combine multiple files—typically a legitimate, harmless application (like a PDF or a game installer) and a malicious payload (like a trojan or keylogger)—into a single, executable wrapper. When the victim runs the combined file, the legitimate application opens normally, while the malware silently executes in the background.

Understanding Ljoiner (File Binders)
To an end-user, a joined file appears perfectly normal; they double-click an invoice, the invoice opens, and they suspect nothing. For a security analyst, a file binder is a critical social engineering enabler (`T1204.002`). It masks the execution of the payload, increasing the likelihood of successful infection by exploiting the user's trust in the 'decoy' file.

Execution and Deception Mechanics
Attackers use tools flagged as Ljoiner (like the infamous 'IExpress' built into Windows, or custom underground tools) to package their malware. The binder configures a stub executable (`T1027`). Upon execution, the stub extracts both the decoy file and the malicious payload to a temporary directory (e.g., `%Temp%`). It then launches the decoy file visibly for the user, and simultaneously executes the hidden malware payload (`T1055`) using techniques like Process Hollowing or simply running it as a hidden background process.

Indicators of Compromise & Impact
The impact depends on the hidden payload (ransomware, RAT, etc.). Host-based IoCs include EDR alerts for 'Suspicious Process Spawning' (e.g., a PDF reader process unexpectedly spawning `cmd.exe` or `powershell.exe`). The sudden creation of unknown executables in the `%Temp%` directory immediately following the opening of a seemingly harmless document is a strong indicator. Static analysis of the joined file will often reveal a highly anomalous file structure, with multiple embedded PE (Portable Executable) headers.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_LJOINER_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ljoiner"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "ljoiner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Ljoiner (Ransomware) Execution & Triage
id: dc9af2ac-4b04-553c-bcd7-e58f0dee002b
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Ljoiner malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/ljoiner
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1204_002
- attack.t1055
- attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_LJOINER_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ljoiner tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "ljoiner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the suspected joined file immediately to prevent further execution of the hidden payload.
2. Analyze EDR telemetry to determine exactly what processes were spawned by the joined file to identify the true nature of the malware.
3. Submit the joined file to a dynamic analysis sandbox (like Any.Run) to safely separate and analyze the decoy and the payload.
4. Educate users on the dangers of opening unexpected attachments, even if they appear to be standard document formats.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume a file is safe simply because it has a familiar icon (like a PDF icon); binders easily spoof file icons.
2. Avoid relying solely on static scanning; the binder often encrypts or obfuscates the payload, requiring behavioral analysis to detect the execution.

References & External Analysis

• Search "ljoiner" on VirusTotal (External Analysis)
• Search "ljoiner" on Any.Run (Sandbox Sandbox)
• Search "ljoiner" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Zenpak
• Ekisoli
• Vehidis
• Spynet
• Multim
• Cryptexe
• Ilomo
• Genericrxeb

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/ljoiner.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.