The Dangers of Trojanized Super Mario Downloads

The world of gaming is an enchanting place, drawing millions into its immersive stories and worlds, with games like the classic Super Mario series at the forefront.

For fans of the beloved Super Mario series, “Super Mario 3: Mario Forever” was a delightful treat. Released in 2003 by Buziol Games for Windows, this free-to-play remake of the Nintendo classic quickly caught the attention of millions. It wasn’t just a nostalgia trip; players appreciated the familiar mechanics of the Mario series paired with updated graphics, revamped styling, and fresh sound.

However, remember the age-old advice about avoiding pirated games? Well, the dangers have evolved.

Now, we’re seeing threats in the form of Trojanized free-to-play games, with Super Mario 3: Mario Forever being a recent example.

A Deep Dive into the Infected “Mario Forever” Game

When players excitedly launch the “Mario Forever” game, thinking they’re about to dive into a nostalgic adventure, they’re unwittingly setting off a series of malicious events.

Here’s a breakdown of this malware infiltrates your device:

1. Distribution Channels: The compromised game installer is packaged as a self-extracting archive executable. The exact distribution channels remain unknown.
2. Promotion Tactics: It’s believed the game is being advertised on gaming forums, social media groups, and might be force-fed to users through malicious online advertising (malvertizing) and Black Hat SEO practices.

What’s Inside the Package

1. Three Executables: The archive reveals three distinct files:
   • “super-mario-forever-v702e.exe”: This installs the actual Mario game.
   • “java.exe” & “atom.exe”: Both are sneakily introduced to the user’s AppData directory as the game installs.
2. Malicious Functions:
   • Monero Miner: After planting the malicious files on the disk, they’re activated to run an XMR (Monero) miner and a SupremeBot mining client. The “java.exe” operates as a Monero miner, gathering hardware specifics of the victim’s device and liaising with a mining server at “gulf[.]moneroocean[.]stream”.
   • SupremeBot’s Deception: “atom.exe”, or SupremeBot, is especially crafty. It replicates itself, stowing away the duplicate in a concealed folder within the game’s directory. It then sets a task scheduler, triggering the duplicate every 15 minutes. To remain undetected, it mimics a genuine process, erases the original file, and terminates the initial process. Post this, the malware establishes a C2 connection for transmitting data, registering the client, and receiving mining setups for Monero mining. This bot’s final move? Fetching an additional malicious payload from its C2 connection, arriving as “wime.exe”.
3. Enter Umbral Stealer: “wime.exe” isn’t just any malware. It’s the notorious Umbral Stealer, an open-source data thief coded in C# and available on GitHub from April 2023. This pilfers:
   • Browser-stored data, like passwords and session token-filled cookies.
   • Cryptowallet details.
   • Credentials and authentication codes for platforms such as Discord, Minecraft, Roblox, and Telegram.

The tainted “Mario Forever” game installer is Pandora’s box of cyber threats. It’s a timely reminder that even in the gaming world, it’s crucial to tread with caution and ensure software is downloaded from trustworthy sources.

The Threat Landscape of Malware: It’s Not Just Mario Forever!

PCs have always been the target of cybercrime, but with the rise of gaming technology, gamers are now being targeted through multiple games. Since gaming PCs are known for their superior performance and high-end specifications, this inadvertently makes them a tempting target for cybercriminals.

Why Gaming PCs?

High-Spec Machines

Gamers often invest in computers with robust specifications to handle the demanding graphics and processing requirements of modern games. Especially important is the graphics card. Ironically, this same high-performance graphics card, so prized in the gaming world, is what makes these PCs attractive for illicit cryptocurrency mining.

The Lure of Free or Pirated Games

Many gamers, in pursuit of saving money or accessing games not readily available, often venture into the gray zone of pirated games or download free ones from sketchy sources. These platforms provide a ripe playground for cybercriminals to embed their malicious miners.

The Lure of Free or Pirated Games

Stealthy cryptocurrency miners are adept at running quietly in the background, ensuring that their presence remains concealed. For an average user, detecting such hidden operations can be quite a challenge. A robust antivirus software, designed to track and identify such anomalies, becomes a necessity.

Popular Games and The Threat Landscape

Roblox and Minecraft

Umbral’s penchant for stealing session tokens from these games is no coincidence. Both Roblox and Minecraft consistently appear at the top of the list of games most targeted by cyber adversaries. The vast user base, combined with the potential value of in-game assets, makes these platforms especially lucrative.

Masquerading Malware

Cybercriminals often camouflage their malicious software under the guise of popular add-ons or modifications. A recent instance highlighted the Fractureiser stealer, which was distributed pretending to be a mod for Minecraft.

While the gaming world offers endless excitement and immersion, it is evident that it comes with its set of risks. That’s why, as emphasized, it is imperative for gamers to be cautious, always opting for trusted sources when downloading games or mods, and investing in reliable security software to protect their prized gaming rigs.

How to Safeguard Yourself Against Super Mario-Inspired Cyberattacks

The recent trojanized Super Mario loader is a stark reminder of a tragic reality— that there are risks everywhere. However, with conscious steps and vigilance, both individuals and organizations can shield themselves from potential threats.

Gamers, from casual to professional, as well as organizations, are potential targets for cybercriminals. Whether it’s a nostalgic journey through the classic Mario world or an intense battle royale session, ensuring safety should be at the forefront.

By understanding the potential threats and adopting preventive measures, we can create a safe environment for everyone in the gaming community.

Preventive Measures for Organizations

1. Promote Awareness: One of the main defenses against cyber threats is knowledge. Organizations should invest in security awareness programs to educate their employees about the dangers of unverified links and attachments. Recognizing phishing attempts and dubious URLs is a key skill in today’s digital workspace.
2. Revise Security Policies: Updating information security policies to strictly prohibit crypto-mining software installation on company systems can minimize the potential for breaches.
3. Technological Safeguards: Consider blocking access to notorious torrent sites known to distribute malware. Also, keep an eye out for unusual spikes in CPU and RAM usage, often indicators of malware activity.

Tips for Gamers

1. Trust Only Official Sources: Limit your game downloads to verified platforms and official sources. This ensures you’re not inadvertently downloading malicious software.
2. Seek Legal Discounts: Everyone loves a bargain, but turning to illicit copies from uncertain sites is a risk not worth taking.
3. Beware of Too-Good-to-Be-True Offers: Highly anticipated games won’t be available before their official launch. If a platform-specific version seems too dreamy to be true, it probably is.
4. Exercise Caution with Mods and Cheats: While mods can enhance gameplay, ensure they come from reliable sources. Cheats, on the other hand, are best sidestepped entirely.
5. Secure Your Credentials: Instead of saving passwords in browsers, opt for a trusted password manager to keep your details safe.
6. Opt for Gaming-Focused Security Solutions: Choose a dedicated security software tailored for gaming. This ensures protection without compromising your gaming experience.

In an interconnected world, being proactive is the key to ensuring a safe gaming environment. Whether you’re an organization or an individual, equipping yourself with knowledge and the right tools can mean the difference between a seamless gaming experience and a cyber nightmare.

Stay informed, stay vigilant, and game on safely!

References:

Trojanized Super Mario Installer Goes After Gamer Data

Trojanized Super Mario Game Installer Spreads SupremeBot Malware

Malware Campaign Hides Ransomware in Super Mario Wrapper

Minecraft players under attack