MITRE ATT&CKsoftware (malware)
S9033 Fooder
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2026-04-20
Description
Fooder is a custom 64-bit C/C++ loader used by MuddyWater that can decrypt and reflectively load embedded payloads such as a go-socks5 proxy utility, the open-source HackBrowserData infostealer, or the MuddyViper backdoor. Fooder has frequently masqueraded as an entertainment executable, such as the Snake game (e.g., `Snake_Game.exe`).
Related
Uses · MITRE ATT&CK (7)
- T1678 Delay Execution technique
- T1620 Reflective Code Loading technique
- T1134.001 Token Impersonation/Theft sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1027 Obfuscated Files or Information technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- G0069 MuddyWater group
References
- https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/ ESET_MuddyWater_Dec2025