{
  "family": "juntador",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nJuntador is not a traditional standalone malware family, but rather a specific classification for a \"Binder\" or \"Joiner\" utility. These tools are heavily utilized by cybercriminals to merge multiple executable files—typically a malicious payload (like a RAT or info-stealer) and a legitimate, benign application (like a game installer or a PDF document)—into a single, deceptive executable file. This is a primary technique used for social engineering and initial access.\n\n<h3>Technical Architecture and Capabilities</h3>\nJuntador utilities are the packaging mechanism for malware. They are designed to trick the end-user into executing a malicious payload by hiding it behind a facade of legitimacy.\n\nKey features of a Juntador/Binder include:\n<ul>\n<li><strong>File Merging:</strong> The attacker uses the binder to combine `malware.exe` and `legit_game.exe` into a new file, often named `setup_game.exe`.</li>\n<li><strong>Simultaneous Execution:</strong> When the victim double-clicks the bound file, the Juntador stub executes both embedded files simultaneously in the background. The user sees the legitimate game installer launch normally, completely unaware that the malicious payload has also executed and infected their system.</li>\n<li><strong>Icon and Extension Spoofing:</strong> Advanced binders allow the attacker to apply the icon of a legitimate program (like an Adobe PDF icon) to the final executable. They often employ techniques like the \"Right-to-Left Override\" (RLO) character to spoof the file extension, making `invoice_pdf.exe` appear as `invoice_exe.pdf`.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe detection of a Juntador artifact indicates that a user has fallen victim to a social engineering attack and executed a Trojanized file. The true threat lies not in the binder itself, but in the specific, hidden payloads it was designed to deliver. A successful Juntador execution guarantees the endpoint has been compromised by at least one piece of malware.\n\n<h3>Incident Response and Advanced Analysis</h3>\n<ul>\n<li><strong>Payload Extraction:</strong> The primary goal of incident response is to extract and identify the hidden payloads. The bound file must be submitted to an isolated malware sandbox or manually reverse-engineered to separate the benign \"decoy\" from the malicious executable.</li>\n<li><strong>Endpoint Isolation:</strong> Treat the endpoint as fully compromised. Isolate it from the network until the specific payloads delivered by the Juntador file can be identified and neutralized.</li>\n<li><strong>Security Awareness Training:</strong> The success of a bound file relies entirely on user interaction. The incident should trigger targeted security awareness training regarding the dangers of downloading software from untrusted sources and how to verify file extensions.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Binder.Juntador",
    "HackTool.Joiner",
    "Win32/Juntador"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027",
    "T1204.002",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:04:40Z",
  "type": "Trojan Dropper / Binder",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}