Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba Payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

Modifies boot configuration data using bcdedit

Drops file in Drivers directory

Executes dropped EXE

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.