Academy
TermTechnique

Joiner

A tool that combines malware with a legitimate installer in a single file: the user sees the program they expect while the malware runs in the background.

Flow

  1. 1Files combined
  2. 2User runs it
  3. 3Both run
Related families
CryptBot, Vidar, RedLine Stealer
MITRE ATT&CK
T1036 · Masquerading
Sources
6 sources
01

Overview

A joiner is used to avoid raising suspicion. The installation actually completes; at the same time a hidden second file runs. MITRE ATT&CK

This method is common in unlicensed software, game cheats and “free” activation tools; the user is already prepared to run an unknown file. Zscaler

02

How it works

  1. 1

    Files combined

    The legitimate installer and the malware are made into a single package.

  2. 2

    User runs it

    The package comes with the name and icon of the expected program. MITRE ATT&CK

  3. 3

    Both run

    While the installation screen opens, the malware starts in the background. MITRE ATT&CK

03

Real-world examples

Fake KMSPico activator

CryptBot profile

Fake KMSPico activation tools ran the tool the user expected while also installing CryptBot, which steals crypto wallets. BleepingComputer

Backdoored Windows 11 downloads

Vidar profile

Vidar was distributed in packages on sites impersonating the Windows 11 download page. Zscaler

04

How to detect it

  • An installer process starting a child process unrelated to the program it installs, and that process accessing browser data. MITRE ATT&CK
05

What to do

  • Have software installed only from the vendor’s site or the corporate software center; block unsigned installers. MITRE ATT&CK
06

MITRE ATT&CK

T1036MasqueradingT1204.002User Execution: Malicious File
07

Related families and terms

Families

CryptBotActiveVidarActiveRedLine StealerActive

Report

Infostealer Threat Report — October 2026

Terms

CrypterMalvertisingInfection chain
08

Sources

  1. 1Masquerading (T1036) · MITRE ATT&CK
  2. 2User Execution: Malicious File (T1204.002) · MITRE ATT&CK
  3. 3Infostealer malware mimicking pirated software downloads · Zscaler
  4. 4Malicious KMSPico installers steal cryptocurrency wallets · BleepingComputer
  5. 5Vidar distributed through backdoored Windows 11 downloads · Zscaler
  6. 6Behavior Prevention on Endpoint (M1040) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans