FooderMalware
Fooder is a custom 64-bit C/C++ loader used by MuddyWater that can decrypt and reflectively load embedded payloads such as a go-socks5 proxy utility, the open-source HackBrowserData infostealer, or the MuddyViper backdoor. Fooder has frequently masqueraded as an entertainment executable, such as the Snake game (e.g., `Snake_Game.exe`).From MITRE ATT&CK
Last reported 13 months ago, by Group-IB1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1665Hide Infrastructure
“…has revealed active use of Amazon Web Services (AWS) for hosting malicious assets, and Cloudflare services have been leveraged to hide infrastructure fingerprints and impede analysis.”
- T1684Social Engineering
“Phishing Awareness: Conduct regular employee training on recognizing and reporting phishing and social engineering attempts.”
What the reports say
1 report, newest first · the exact sentence from each-
Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025“Multiple new malware variants and tools have been observed to be weaponised by MuddyWater: StealthCache, Phoenix, Fooder, LiteInject, and others.”
Indicators in its reports
named in the reports above- 40dead1e1d831076…5af71a9b5e05in 1 report
- filetransfer[.]ioin 1 report
- sync[.]comin 1 report
- 5f22f4c4fdb36c4f…7b9ef0b691c2in 1 report
- f782dfdc7ce624f9…561c8af13db0in 1 report
- hxxps://netivtech[.]org/registerin 1 report
- netivtech[.]orgin 1 report
- hxxps://netivtech[.]org/imalivein 1 report
- hxxps://netivtech[.]org/requestin 1 report
- hxxp://46.101.36[.]39:443/imalivein 1 report
- 46.101.36[.]39in 1 report
- hxxp://46.101.36[.]39/registerin 1 report
- hxxp://46.101.36[.]39:443/requestin 1 report
- hxxps://netivtech[.]org/rq13in 1 report
- hxxps://netivtech[.]org/adadin 1 report
- hxxps://netivtech[.]org/aq36in 1 report
- 162.255.119[.]28in 1 report
- www.netivtech[.]orgin 1 report
- 91.195.240[.]19in 1 report
- 104.21.81[.]7in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.