{
  "family": "gorillaprice",
  "sample_count": 34,
  "category": "adware",
  "description": "GorillaPrice (cataloged across endpoint security telemetry and antimalware engines under signatures including Adware:Win32/GorillaPrice, PUA:Win32/GorillaPrice, and PUP.Optional.GorillaPrice) is an aggressive shopping adware and browser-modifying potentially unwanted application active since 2014. Marketed to consumers as a helpful comparison-shopping and discount coupon utility, GorillaPrice typically arrives bundled with freeware downloads, deceptive browser extension packages, and media players. Once installed, GorillaPrice runs persistent background processes and installs extension hooks into Google Chrome, Mozilla Firefox, and Internet Explorer. As users navigate e-commerce and retail portals (such as Amazon, eBay, or Walmart), GorillaPrice intercepts visited URLs, scrapes product keywords, and injects intrusive overlay price comparison widgets, deceptive discount banners, and sponsored redirection links into legitimate shopping pages, monetizing traffic through affiliate marketing commissions.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/GorillaPrice",
    "PUA:Win32/GorillaPrice",
    "PUP.Optional.GorillaPrice",
    "Adware.GorillaPrice",
    "Win32/GorillaPrice",
    "GorillaPrice Shopping Assistant"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/GorillaPrice?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "GorillaPrice is an aggressive adware program that injects unauthorized price-comparison widgets, discount coupons, and sponsored banners into web browsers."
      }
    },
    {
      "@type": "Question",
      "name": "How does GorillaPrice monitor online shopping activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks browser navigation APIs to inspect visited e-commerce URLs, extracting product names and keywords to request targeted affiliate ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does GorillaPrice get installed on Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is commonly bundled inside free software downloads, third-party download wrappers, and deceptive browser extension pop-ups."
      }
    },
    {
      "@type": "Question",
      "name": "Why is GorillaPrice classified as a Potentially Unwanted Application?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Due to deceptive distribution, unauthorized browser modifications, data tracking of shopping habits, and intrusive banner injection, security vendors classify it as a PUA."
      }
    },
    {
      "@type": "Question",
      "name": "How can I remove GorillaPrice from my web browser?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remove the GorillaPrice extension from browser settings, uninstall the program via Windows Settings, and perform a full scan with Windows Security or Malwarebytes."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Bundlers",
    "Malicious Browser Extension Stores",
    "Aggressive Landing Pages"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Page Shopping Widget Injection",
    "Retail Product URL Scraping",
    "Browser Extension Hooking",
    "Affiliate Link Redirection",
    "Background Telemetry Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Browser Extension Archive (CRX/XPI)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET queries transmitting visited e-commerce URLs and product identifiers to remote affiliate syndication servers",
      "Inbound HTTP responses delivering external CSS and JavaScript code to render coupon comparison pop-up layers"
    ],
    "evasion_techniques": [
      "Using legitimate code-signing certificates to reduce warnings during installation",
      "Delaying ad injection displays until shopping intent is verified via keyword matching to avoid triggering user suspicion"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0",
      "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1"
    ],
    "registry_keys": [
      "HKCU\\Software\\GorillaPrice",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\GorillaPrice"
    ],
    "file_paths": [
      "%ProgramFiles%\\GorillaPrice\\gorillaprice.exe",
      "%AppData%\\GorillaPrice\\helper.dll",
      "%Temp%\\gp_setup.exe"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Enforce strict browser extension allowlisting via Group Policy (GPO) to prevent unverified shopping helpers",
    "Block connections to known coupon injection and ad-affiliate networks at enterprise web proxies"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/GorillaPrice",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/GorillaPrice"
    },
    {
      "name": "Malwarebytes Threat Intelligence - PUP.Optional.GorillaPrice",
      "url": "https://www.malwarebytes.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/GorillaPrice.A",
      "PUA:Win32/GorillaPrice.B"
    ]
  },
  "motivation": "Affiliate E-Commerce Monetization & Click Injection",
  "sample_hashes": []
}