{
  "family": "garrun",
  "sample_count": 21,
  "category": "trojan",
  "description": "Garrun (identified in security research telemetry as Trojan:Win32/Garrun, Trojan:Win32/Garrun.A, and Backdoor:Win32/Garrun) is an evasive Windows trojan backdoor and command execution implant. Infiltrating target endpoints via weaponized spearphishing email attachments and secondary exploit droppers, Garrun deploys a multi-stage execution chain that verifies whether it is operating within an isolated analysis sandbox. Once safe execution is confirmed, Garrun establishes autostart persistence by configuring Windows Task Scheduler tasks and modifying startup registry keys. It opens an encrypted command-and-control connection to remote infrastructure, giving attackers interactive command shell execution, arbitrary file upload and download capabilities, and the ability to stage auxiliary payload components.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Garrun",
    "Trojan:Win32/Garrun.A",
    "Backdoor:Win32/Garrun",
    "Win32/Garrun",
    "Backdoor.Garrun"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Garrun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Garrun is an evasive Windows backdoor trojan that provides remote operators with interactive command shell access."
      }
    },
    {
      "@type": "Question",
      "name": "How does Garrun achieve persistent execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures Windows scheduled tasks and modifies registry run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "What remote capabilities are supported by Garrun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It supports arbitrary command shell execution, remote file transfer, process staging, and host reconnaissance."
      }
    },
    {
      "@type": "Question",
      "name": "How is Garrun delivered to target systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through weaponized spearphishing email attachments and secondary exploit dropper payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can Garrun infections be eradicated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate suspicious backdoor processes, delete scheduled tasks and registry keys, and block remote C2 domains."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1053.005",
    "T1547.001",
    "T1071.001",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Garrun",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Garrun"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Garrun",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.garrun"
    },
    {
      "name": "VirusTotal Threat Intelligence - Garrun Sample Telemetry",
      "url": "https://www.virustotal.com/gui/home/upload"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Sever the affected system's network connections immediately to prevent attacker command execution.",
    "Terminate active backdoor processes and inspect %APPDATA% and %TEMP% for staged binaries.",
    "Remove scheduled tasks configured by Garrun using schtasks.exe.",
    "Clean registry run values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block identified C2 IP addresses and domain names at perimeter firewalls and DNS resolvers."
  ],
  "what_to_avoid": [
    "Do not allow the infected host to maintain internet connectivity during analysis.",
    "Do not ignore secondary payloads that may have been downloaded via Ingress Tool Transfer routines."
  ],
  "target_industries": [
    "Commercial Enterprises",
    "Financial Services",
    "Manufacturing"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Cybercriminal Operators"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Interactive Remote Access & Secondary Payload Staging",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}