{"id":1420,"date":"2022-02-28T10:11:04","date_gmt":"2022-02-28T09:11:04","guid":{"rendered":"https:\/\/cyber-detect.com\/?p=1420"},"modified":"2022-03-02T14:15:15","modified_gmt":"2022-03-02T13:15:15","slug":"gorille-identifies-obfuscated-malicious-code-the-case-of-emotet","status":"publish","type":"post","link":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/","title":{"rendered":"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET"},"content":{"rendered":"
\n
<\/div>\n<\/div><\/div><\/div>\n\n
\n

Regularly, variants of Emotet pass under the radar of anti-virus software, because they are obfuscated. The ANSSI warned of this situation in the alert bulletin<\/a> dated September 7, 2020. At Cyber-Detect, we therefore wondered if Gorille was also able to detect Emotet variants. <\/p>\n<\/div><\/div><\/div>\n\n

\n

Emotet is a banking Trojan that has been rampant since 2014. Emotet has evolved and new versions include new spam and malware delivery services. According to the U.S. Department of Homeland Security, the damage caused by Emotet would amount to $1M, making it one of the most expensive malware<\/a>. <\/p>\n<\/div><\/div><\/div>\n\n

\n

For that, we took the executable whose sha256 is : b97a688035a6d8e3db8d442db354632fdcedee0ab8610b1c101de532e6df9bd6<\/p>\n<\/div><\/div><\/div>\n\n

\n

This executable contains a variant of EMOTET. We submitted it to Virus Total on October 14, 2020. Only seven out of sixty-two anti-viruses on the Virus Total platform detected the presence of malicious code in the executable.<\/p>\n<\/div><\/div><\/div>\n\n

\n
\"\"<\/figure>\n<\/div><\/div><\/div>\n\n
\n

<\/p>\n<\/div><\/div><\/div>\n\n

\n

Then, we submitted, this same executable to Gorilla on the site : http:\/\/demo.gorille.tech\/<\/a><\/p>\n<\/div><\/div><\/div>\n\n

\n

<\/p>\n<\/div><\/div><\/div>\n\n

\n
\"\"<\/figure>\n<\/div><\/div><\/div>\n\n
\n

In less than a second, Gorille answers that this executable is malicious with a static analysis:<\/p>\n<\/div><\/div><\/div>\n\n

\n

<\/p>\n<\/div><\/div><\/div>\n\n

\n
\"\"<\/figure>\n<\/div><\/div><\/div>\n\n
\n

<\/p>\n<\/div><\/div><\/div>\n\n

\n

The first conclusion is that Gorille detects this variant of Emotet unlike the vast majority of anti-viruses. This shows Gorille’s ability to analyze weak signals that remain visible despite the protections applied to this sample of Emotet. Gorilla’s morphological analysis engine is able to detect weak signals because it looks for correlations between low-level malicious behavior, i.e., at the executable code level. <\/p>\n<\/div><\/div><\/div>\n\n

\n

To go further, we have performed a dynamic analysis. The static analysis is fast, but does not allow to get past the different obfuscations linked to packers. On the contrary, the dynamic analysis allows to see the different processes that are launched and thwarts many obfuscations, which allows to analyze the load (payload) of the sample. <\/p>\n<\/div><\/div><\/div>\n\n

\n

The result of the dynamic analysis, below, confirms the previous one. The analysis time is about 40 seconds.<\/p>\n<\/div><\/div><\/div>\n\n

\n

<\/p>\n<\/div><\/div><\/div>\n\n

\n
\"\"<\/figure>\n<\/div><\/div><\/div>\n\n
\n

<\/p>\n<\/div><\/div><\/div>\n\n

\n

LThe dynamic analysis also shows that this Emotet sample is deployed by depackaging 4 successive waves of code. Each wave of code is analyzed. This Emotet sample contains 33 sites in common with known malicious code. Each of these sites corresponds to a malicious behavior. This triggered the Gorilla alert. Gorilla is also an intelligent reverse-engineering tool. The first wave of code in this sample contains the code of an application that is described by this site: https:\/\/www.codeproject.com\/Articles\/1667\/CPJAImage-Yet-another-image-drawing-class\/.<\/a> <\/p>\n<\/div><\/div><\/div>\n\n

\n

The code of CPJAImage has been modified in order to decrypt the program that will allow to install Emotet. The passage from the decryption of the load to its execution is given below: <\/p>\n<\/div><\/div><\/div>\n\n

\n
\"\"<\/figure>\n<\/div><\/div><\/div>\n\n
\n

In conclusion, Gorille’s morphological analysis engine analyzes the behaviors of submitted binary files and overcomes the various protection measures that hide the intent of the analyzed file. The case study presented here with a variant of Emotet, undetected by most Anti-Virus software, demonstrates the effectiveness of Gorille.<\/p>\n<\/div><\/div><\/div>\n\n

\n
<\/div>\n<\/div><\/div><\/div>\n\n
\n

<\/p>\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"

Emotet variants regularly slip under the radar of anti-virus software because they are obfuscated.<\/p>\n","protected":false},"author":1,"featured_media":951,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[21],"tags":[],"class_list":["post-1420","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-webinars"],"acf":[],"yoast_head":"\nGORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET - Cyber-Detect<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET - Cyber-Detect\" \/>\n<meta property=\"og:description\" content=\"Emotet variants regularly slip under the radar of anti-virus software because they are obfuscated.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/\" \/>\n<meta property=\"og:site_name\" content=\"Cyber-Detect\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-28T09:11:04+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-03-02T13:15:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-1024x770.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"770\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"adminbilliotte\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"adminbilliotte\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/\"},\"author\":{\"name\":\"adminbilliotte\",\"@id\":\"https:\/\/cyber-detect.com\/en\/#\/schema\/person\/9bc85be73e00a52bbc3294f538e0ae47\"},\"headline\":\"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET\",\"datePublished\":\"2022-02-28T09:11:04+00:00\",\"dateModified\":\"2022-03-02T13:15:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/\"},\"wordCount\":495,\"publisher\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-scaled.jpg\",\"articleSection\":[\"Webinars\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/\",\"url\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/\",\"name\":\"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET - Cyber-Detect\",\"isPartOf\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-scaled.jpg\",\"datePublished\":\"2022-02-28T09:11:04+00:00\",\"dateModified\":\"2022-03-02T13:15:15+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#primaryimage\",\"url\":\"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-scaled.jpg\",\"contentUrl\":\"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-scaled.jpg\",\"width\":2560,\"height\":1924},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cyber-detect.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cyber-detect.com\/en\/#website\",\"url\":\"https:\/\/cyber-detect.com\/en\/\",\"name\":\"Cyber-Detect\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cyber-detect.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/cyber-detect.com\/en\/#organization\",\"name\":\"Cyber-Detect\",\"url\":\"https:\/\/cyber-detect.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cyber-detect.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/AI-CYBER-DETECT-MORPHOLOGICAL-ANALYSIS-PAYSAGE-RGB-white-vecto.svg\",\"contentUrl\":\"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/AI-CYBER-DETECT-MORPHOLOGICAL-ANALYSIS-PAYSAGE-RGB-white-vecto.svg\",\"width\":728,\"height\":242,\"caption\":\"Cyber-Detect\"},\"image\":{\"@id\":\"https:\/\/cyber-detect.com\/en\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/cyber-detect.com\/en\/#\/schema\/person\/9bc85be73e00a52bbc3294f538e0ae47\",\"name\":\"adminbilliotte\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cyber-detect.com\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e8ef84d61786269a92f9010e4333520a29594c88cc4f2c10f2805d592432d683?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e8ef84d61786269a92f9010e4333520a29594c88cc4f2c10f2805d592432d683?s=96&d=mm&r=g\",\"caption\":\"adminbilliotte\"},\"url\":\"https:\/\/cyber-detect.com\/en\/author\/adminbilliotte\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET - Cyber-Detect","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/","og_locale":"en_US","og_type":"article","og_title":"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET - Cyber-Detect","og_description":"Emotet variants regularly slip under the radar of anti-virus software because they are obfuscated.","og_url":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/","og_site_name":"Cyber-Detect","article_published_time":"2022-02-28T09:11:04+00:00","article_modified_time":"2022-03-02T13:15:15+00:00","og_image":[{"width":1024,"height":770,"url":"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-1024x770.jpg","type":"image\/jpeg"}],"author":"adminbilliotte","twitter_card":"summary_large_image","twitter_misc":{"Written by":"adminbilliotte","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#article","isPartOf":{"@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/"},"author":{"name":"adminbilliotte","@id":"https:\/\/cyber-detect.com\/en\/#\/schema\/person\/9bc85be73e00a52bbc3294f538e0ae47"},"headline":"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET","datePublished":"2022-02-28T09:11:04+00:00","dateModified":"2022-03-02T13:15:15+00:00","mainEntityOfPage":{"@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/"},"wordCount":495,"publisher":{"@id":"https:\/\/cyber-detect.com\/en\/#organization"},"image":{"@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#primaryimage"},"thumbnailUrl":"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-scaled.jpg","articleSection":["Webinars"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/","url":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/","name":"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET - Cyber-Detect","isPartOf":{"@id":"https:\/\/cyber-detect.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#primaryimage"},"image":{"@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#primaryimage"},"thumbnailUrl":"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-scaled.jpg","datePublished":"2022-02-28T09:11:04+00:00","dateModified":"2022-03-02T13:15:15+00:00","breadcrumb":{"@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#primaryimage","url":"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-scaled.jpg","contentUrl":"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/michael-dziedzic-0W4XLGITrHg-unsplash-scaled.jpg","width":2560,"height":1924},{"@type":"BreadcrumbList","@id":"https:\/\/cyber-detect.com\/en\/gorille-identifies-obfuscated-malicious-code-the-case-of-emotet\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cyber-detect.com\/en\/"},{"@type":"ListItem","position":2,"name":"GORILLE\u00a9 identifies obfuscated malicious code : the case of EMOTET"}]},{"@type":"WebSite","@id":"https:\/\/cyber-detect.com\/en\/#website","url":"https:\/\/cyber-detect.com\/en\/","name":"Cyber-Detect","description":"","publisher":{"@id":"https:\/\/cyber-detect.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cyber-detect.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cyber-detect.com\/en\/#organization","name":"Cyber-Detect","url":"https:\/\/cyber-detect.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cyber-detect.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/AI-CYBER-DETECT-MORPHOLOGICAL-ANALYSIS-PAYSAGE-RGB-white-vecto.svg","contentUrl":"https:\/\/cyber-detect.com\/wp-content\/uploads\/2021\/08\/AI-CYBER-DETECT-MORPHOLOGICAL-ANALYSIS-PAYSAGE-RGB-white-vecto.svg","width":728,"height":242,"caption":"Cyber-Detect"},"image":{"@id":"https:\/\/cyber-detect.com\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/cyber-detect.com\/en\/#\/schema\/person\/9bc85be73e00a52bbc3294f538e0ae47","name":"adminbilliotte","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cyber-detect.com\/en\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e8ef84d61786269a92f9010e4333520a29594c88cc4f2c10f2805d592432d683?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e8ef84d61786269a92f9010e4333520a29594c88cc4f2c10f2805d592432d683?s=96&d=mm&r=g","caption":"adminbilliotte"},"url":"https:\/\/cyber-detect.com\/en\/author\/adminbilliotte\/"}]}},"_links":{"self":[{"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/posts\/1420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/comments?post=1420"}],"version-history":[{"count":4,"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/posts\/1420\/revisions"}],"predecessor-version":[{"id":1427,"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/posts\/1420\/revisions\/1427"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/media\/951"}],"wp:attachment":[{"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/media?parent=1420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/categories?post=1420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber-detect.com\/en\/wp-json\/wp\/v2\/tags?post=1420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}