malware

Fooder S9033

Type: malware
Platform: Windows
Created: 20 April 2026
Last modified: 23 April 2026

Fooder is a custom 64-bit C/C++ loader used by MuddyWater that can decrypt and reflectively load embedded payloads such as a go-socks5 proxy utility, the open-source HackBrowserData infostealer, or the MuddyViper backdoor. Fooder has frequently masqueraded as an entertainment executable, such as the Snake game (e.g., Snake_Game.exe).[1]

Techniques33rd pct

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S9033

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-02-15	2024-03-05	3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	aeff2bb5-3483-48d4-9be8-c8976194be1e
Splunk	This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	a4c76d0a-56b6-44be-814b-939746c4d406
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
	Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a80d927d-ac6e-443f-a867-e8d6e3897318
Splunk	The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)	Anomaly	stable	process_creation	windows · linux	CrowdStrike · Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	9a8d5516-4c5e-11ef-9d42-acde48001122
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	linux	Sysmon	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2021-11-27	e2072cab-8c9a-459b-b63c-40ae79e27031
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	macos	-	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-26	719c22d7-c11a-4f2c-93a6-2cfdd5412f68
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	CVE-2015-1641	critical	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	7993792c-5ce2-4475-a3db-a3a5539827ef
	Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2023-02-15	2025-06-04	cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
	Detects the execution of certutil with the "encode" flag to encode a file to base64. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-02-24	2024-03-05	e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
	Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2024-03-05	82a6714f-4899-4f16-9c1e-9a333544d4c3
	Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-06-24	—	13c02350-4177-4e45-ac17-cf7ca628ff5e
	Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)	2020-05-26	2026-07-28	d5866ddf-ce8f-4aea-b28e-d96485a20d3d
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Florian Roth (Nextron Systems)	2020-05-20	2023-03-09	3711eee4-a808-4849-8a14-faf733da3612
	Detects a typical pattern of a CobaltStrike BOF which inject into other processes	Generic	test	process_access	windows	Sysmon	Defense Impairment Disable or Modify Tools Execution Native API	-	high	Christian Burkard (Nextron Systems)	2021-08-04	2023-11-28	09706624-b7f6-455d-9d02-adee024cee1d
	Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening an (...)	Generic	test	process_access	windows	Sysmon	Execution Native API Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj (rule), @thefLinkk	2022-06-27	2023-11-28	b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
	Detects execution of the Impersonate tool. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Make and Impersonate Token	-	medium	Sai Prashanth Pulisetti @pulisettis	2022-12-21	2024-11-23	cf0c254b-22f1-4b2b-8221-e137b3c0af94
	Detects creation of default named pipes used by the Koh tool	Generic	test	pipe_created	windows	Sysmon	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Credential Access Steal Application Access Token	-	critical	Nasreddine Bencherchali (Nextron Systems)	2022-07-08	2023-08-07	0adc67e0-a68f-4ffd-9c43-28905aad5d6a
	Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escal (...)	Generic	test	-	windows	WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft	-	high	Stamatis Chatzimangou (st0pp3r)	2024-01-05	—	7b14c76a-c602-4ae6-9717-eff868153fc0
	Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Execution Native API Stealth System Binary Proxy Execution Rundll32	-	high	Alexander Rausch	2020-06-24	2023-03-01	95022b85-ff2a-49fa-939a-d7b8f56eeb9b
	Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Make and Impersonate Token	-	high	Nasreddine Bencherchali (Nextron Systems)	2024-06-26	—	c7d33b50-f690-4b51-8cfb-0fb912a31e57
	Detects execution of the SharpImpersonation tool. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Make and Impersonate Token	-	high	Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems)	2022-12-27	2023-02-13	f89b08d0-77ad-4728-817b-9b16c5a69c7a
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
	Detects Obfuscated use of Clip.exe to execute PowerShell	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2021-09-16	21e4b3c1-4985-4aa4-a6c0-f8639590a5f3
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2022-11-17	b222df08-0e07-11eb-adc1-0242ac120002
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2024-04-05	73e67340-0d25-11eb-adc1-0242ac120002
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2024-04-05	a136cde0-61ad-4a61-9b82-8dc490e60dd2
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2022-11-27	4edf51e1-cb83-4e1a-bc39-800e396068e3
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2023-02-20	f7385ee2-0e0c-11eb-adc1-0242ac120002
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-12-29	7eedcc9d-9fdb-4d94-9c54-474e8affc0c7
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2023-03-04	c70731dd-0097-40ff-b112-f7032f29c16c
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	20e5497e-331c-4cd5-8d36-935f6e2a9a07
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	7034cbbb-cc55-4dc2-8dad-36c0b942e8f1
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	7a922f1b-2635-4d6c-91ef-af228b198ad3
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	175997c5-803c-4b08-8bb0-70b099f47595
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2026-03-16	4bf943c6-5146-4273-98dd-e958fd1e3abf
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Unsupported	unsupported	driver_load	windows	Sysmon	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-07-07	e75c48bd-3434-4d61-94b7-ddfaa2c08487
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-12-31	1b9dc62e-6e9e-42a3-8990-94d7a10007f7
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-12-31	2f211361-7dce-442d-b78a-c04039677378
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	service	windows	WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-11-27	fd0f5778-d3cb-4c9a-9695-66759d04702a
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	service	windows	WinEventLog System	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-11-27	51aa9387-1c53-4153-91cc-d73c59ae1ca9

Title

Description

Fooder S9033

Fooder S9033

Fooder MITRE reference S9033

Standing S9033

Reach

Coverage

Fooder detections S9033