Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

Creates a large amount of network flows

This may indicate a network scan to discover remotely running services.

Modifies boot configuration data using bcdedit

Blocklisted process makes network request

Drops file in Drivers directory

Executes dropped EXE

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.

Stops running service(s)