Mario Meets Malware: An Unwanted Power-Up

Taking a look at the infection chain

• The first one, "super-mario-forever-v702e.exe," installs the authentic Mario game. The remaining two executables, namely "java.exe" and "atom.exe," are discreetly installed in the victim's AppData directory during the game's installation process. 
• Once these malicious executables are present on the disk, the installer proceeds to execute them, initiating an XMR mining operation and launching a SupremeBot mining client.
• Lastly, the SupremeBot component retrieves an additional payload from the C2 server in the form of an executable file named "wime.exe." 
• This file corresponds to Umbral Stealer, an info-stealer designed to pilfer data from the compromised Windows device.

A bit on Umbral Stealer

• Umbral Stealer exfiltrates web browser data (including stored passwords and cookies containing session tokens), cryptocurrency wallets, and credentials and authentication tokens used for popular platforms such as Discord, Minecraft, Roblox, and Telegram.
• It can generate screenshots of the Windows desktop and exploit connected webcams to capture media.
• To avoid detection, the info-stealer incorporates tactics to bypass Windows Defender. If tamper protection is disabled, Umbral Stealer can disable the Windows Defender program entirely. 
• However, if tamper protection is enabled, the malware adds its own process to Windows Defender's exclusion list, granting it immunity from detection by the antivirus software.

The bottom line