Threat intelligence / Malware

Fooder

[Fooder](https://attack.mitre.org/software/S9033) is a custom 64-bit C/C++ loader used by [MuddyWater](https://attack.mitre.org/groups/G0069) that can decrypt and reflectively load embedded payloads such as a go-socks5 proxy utility, the open-source HackBrowserData infostealer, or the [MuddyViper](https://attack.mitre.org/software/S9032) backdoor. [Fooder](https://attack.mitre.org/software/S9033) has frequently masqueraded as an entertainment executable, such as the Snake game (e.g., `Snake_Game.exe`).(Citation: ESET_MuddyWater_Dec2025)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Fooder](https://attack.mitre.org/software/S9033) is a custom 64-bit C/C++ loader used by [MuddyWater](https://attack.mitre.org/groups/G0069) that can decrypt and reflectively load embedded payloads such as a go-socks5 proxy utility, the open-source HackBrowserData infostealer, or the [MuddyViper](https://attack.mitre.org/software/S9032) backdoor. [Fooder](https://attack.mitre.org/software/S9033) has frequently masqueraded as an entertainment executable, such as the Snake game (e.g., `Snake_Game.exe`).(Citation: ESET_MuddyWater_Dec2025)

Labels

malware

8 recorded

Relationships

uses

to Delay Execution

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Reflective Code Loading

Technique

uses

to Token Impersonation/Theft

Technique

uses

from MuddyWater

Group

2 external

References

mitre-attack

S9033

ESET_MuddyWater_Dec2025

https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/