Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

Detects Windows executables referencing non-Windows User-Agents

Detects executables Discord URL observed in first stage droppers

Detects executables containing URLs to raw contents of a Github gist

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables referencing many varying, potentially fake Windows User-Agents

Modifies boot configuration data using bcdedit

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.