A trojanized Super Mario Bros game installer for Windows was discovered by researchers which was used to deliver multiple malware, including an XMR miner, SupremeBot mining client, and the Open-source Umbral stealer.
The threat actors bundled a legitimate installer file of super-mario-forever-v702e with the malicious codes. The researchers at Cyble Research and Intelligence Labs (CRIL) who discovered this pointed out that attackers target gamers because they often use powerful hardware for gaming, which is excellent for mining cryptocurrencies.
Mario Forever is a clone of the original Super Mario that attempts to recreate the classic Nintendo game very faithfully.
The threat actors tampered with the NSIS installer file “Super-Mario-Bros.exe,” the resulting executable file includes three separate executables: “super-mario-forever-v702e.exe,” which is the legitimate Super Mario game application, along with the malicious executables named “java.exe” and “atom.exe,” as shown below.
Once the software is installed, a user interface is launched to play the Super Mario Forever game. But, an XMR (Monero) miner and a SupremeBot mining client are executed in the background.
When “java.exe” is executed, the malware establishes a connection with a mining server “gulf[.]moneroocean[.]stream” to carry out cryptocurrency mining activities. Concurrently, the malware gathers valuable data from the victim’s system, including computer name, username, GPU, CPU, and other relevant details.
This sensitive information is then transferred to a Command and Control (C&C) server. Upon executing SupremeBot (“atom.exe”), it creates a duplicate of itself and places the copy in a hidden folder in the installation directory of the game.
Next, it creates a scheduled task to execute the copy that runs every 15 minutes indefinitely, hiding under the name of a legitimate process.
The initial process is terminated and the original file is deleted to evade detection. Then the malware establishes a C2 connection to transmit information, register the client, and receive mining configuration to begin mining Monero.
In the last stage of the attack, the “atom.exe” retrieves an info-stealing executable, named “wime.exe”, from the C2. The executable unpacks itself and loads the open-source malware Umbral Stealer into the process memory.
Umbral Stealer can also create screenshots of the victim’s Windows desktop or use connected webcams to capture media. All stolen data is stored locally before exfiltrated to the C2 server.
The info-stealer is capable of evading Windows Defender by disabling the program if tamper protection is not enabled. If not, it adds its process to the Defender’s exclusion list.
Additionally, the malware modifies the Windows hosts file to impair the communication of popular antivirus products with company sites, preventing their regular operation and effectiveness.
Those who have recently downloaded Super Mario 3: Mario Forever, must scan your computer for installed malware and remove any that are detected.
If malware is detected, reset your passwords at sensitive sites, such as banking, financial, cryptocurrency, and email sites.
Image Credits : Android: Gadget Hacks
Comments