Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

Modifies boot configuration data using bcdedit

Drops file in Drivers directory

Executes dropped EXE

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.