Fooder

Executive Summary

Fooder is a 64‑bit loader used by the MuddyWater threat group to decrypt and reflectively load multiple payloads, including an SSH proxy, an infostealer, and a backdoor. It masquerades as benign executables such as a Snake game, enabling stealthy delivery on Windows platforms. The loader’s modular design supports in‑memory execution, greatly reducing forensic footprints.

Fooder is a 64‑bit native loader written in C/C++ that acts as the entry point for several advanced adversarial tools grouped under the MuddyWater threat coalition. It decrypts and reflectively loads embedded binary modules directly into memory, obviating the need to write secondary payloads to disk. The bundled payloads include a lightweight Go‑based SOCKS5 proxy utility, the popular open‑source HackBrowserData infostealer, and the MuddyViper backdoor suite. The loader’s construction allows it to masquerade as benign executables – most notably versions of an innocuous Snake game (e.g., *Snake_Game.exe*). This deception facilitates dropper-based delivery while also making signature‑based detection more difficult. Fooder demonstrates typical loading and execution stages found in modern, low‑visibility malware: data obfuscation, in‑memory execution via reflective DLL loading, and remote configuration through the embedded proxies. Operationally, once Fooder is executed it decrypts its payload, injects or loads each module into a secure sandboxed environment, and hands control over to the next stage. The proxy component establishes outbound traffic, typically for command‑and‑control, while the infostealer harvests credential caches from browsers and sends them back to adversary infrastructure. These capabilities illustrate a multi‑stage supply chain that can be leveraged across different campaigns. Overall Fooder exemplifies an advanced, modular loader designed for stealth, persistence, and versatility. Its reliance on in‑memory execution patterns makes it a prime target for behavior‑based detection techniques, while the masquerading strategy underscores the importance of contextual file name analysis in malware triage.

Key Capabilities

• Encrypts and decrypts embedded payloads
• Reflectively loads DLLs and binaries into memory without touching disk
• Hosts multiple modules (proxy, infostealer, backdoor) in one package
• Masquerades as benign games to evade detection

ATT&CK Techniques

Recommended Actions

• Deploy YARA rules targeting Fooder’s distinctive PE header patterns and embedded resource structure
• Monitor for creation or execution of suspect executables named after common games (e.g., Snake_Game.exe) in non‑standard folders
• Block outbound connections on ports commonly used by SOCKS5 proxies unless explicitly authorized
• Employ host‑based EDR solutions that flag reflective DLL loading and in‑memory execution

Suggested Tags