The image below shows the infection chain of the compromised Super Mario Game installer delivering Umbral Stealer. The figure below illustrates the GUI of the Super Mario Forever game following a successful installation. Since its inception in the 1980s, Super Mario games have garnered a massive global following, with millions of players worldwide delighting in the immersive experiences they provide. Over the years, the franchise has continuously evolved, introducing fresh game mechanics, power-ups, and levels across various titles and gaming consoles. The franchise recently saw a resurgence in popularity with new games and an animated movie. Super Mario is an extremely popular video game franchise celebrated for its platforming gameplay, vibrant visuals, unforgettable characters, and captivating music. This incident highlights another reason TAs utilize game installers as a delivery mechanism: the powerful hardware commonly associated with gaming provides valuable computing power for mining cryptocurrencies.
The malware files were found bundled with a legitimate installer file of super-mario-forever-v702e. Recently, CRIL identified a trojanized Super Mario Bros game installer that delivers multiple malicious components, including an XMR miner, SupremeBot mining client, and the Open-source Umbral stealer.
