The Protector

"The Protector" is a malware identified as the Visual Basic Script (VBS) version of GuLoader. This malicious software, designed to exploit and damage computer systems, infiltrates through suspicious downloads, emails, or websites without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. The Protector was discovered on a website named "VgoStore," which is closely related to Remcos, another malware distributor. In a previous article, CheckPoint researchers purposefully omitted any connection between CloudEyE and the new version of GuLoader because they observed the distribution of GuLoader under the alternative name "The Protector." This intentional omission was due to the discovery of GuLoader being distributed via VgoStore under this alternate name. The relationship between VgoStore and Remcos further complicates the malware distribution network and highlights the evolving strategies used by cybercriminals. The application of The Protector is protected with Confuser, a .NET obfuscator that makes the code hard to read and understand, thus making it difficult to detect and remove. Users can check the logic used by DetectItEasy (DiE), a software that identifies packers or protectors, by clicking on the 'S' next to the name of the protector. As cyber threats continue to evolve, understanding and identifying these threats becomes increasingly important in order to develop effective countermeasures.