Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

Detects Windows executables referencing non-Windows User-Agents

Detects executables Discord URL observed in first stage droppers

Detects executables containing URLs to raw contents of a Github gist

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables referencing many varying, potentially fake Windows User-Agents

Modifies boot configuration data using bcdedit

UPX dump on OEP (original entry point)

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.