S9033 Fooder

malwareEnterprise

platformsWindows

also known asFooder

Fooder is a custom 64-bit C/C++ loader used by MuddyWater that can decrypt and reflectively load embedded payloads such as a go-socks5 proxy utility, the open-source HackBrowserData infostealer, or the MuddyViper backdoor. Fooder has frequently masqueraded as an entertainment executable, such as the Snake game (e.g., `Snake_Game.exe`).

techniques used (7)

ATT&CK techniques this enables or maps to.

T1027Obfuscated Files or Information
T1036.005Match Legitimate Resource Name or Location
T1106Native API
T1134.001Token Impersonation/Theft
T1140Deobfuscate/Decode Files or Information
T1620Reflective Code Loading
T1678Delay Execution

used by groups (1)

Threat groups associated with this.

G0069MuddyWater

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan