---
title: Trojanized Super Mario Bros installer spreads malware
description: Researchers have discovered a Trojanized Super Mario Bros game installer that delivers multiple forms of malware, including an XMR miner, SupremeBot mining client and Umbral Stealer.
canonical_url: https://www.acronis.com/en/tru/posts/trojanized-super-mario-bros-installer-spreads-malware/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

20 July 2023

# Trojanized Super Mario Bros installer spreads malware

Researchers have discovered a Trojanized Super Mario Bros game installer that delivers multiple forms of malware, including an XMR miner, SupremeBot mining client and Umbral Stealer.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

∙

Researchers have discovered a Trojanized _Super Mario Bros_ game installer that delivers multiple forms of malware, including an XMR miner, SupremeBot mining client and Umbral Stealer.

Attackers bundled the malicious code with a legitimate installer file named "super-mario-forever-v702e." Gamers are often targeted due to their powerful hardware, which is suitable for mining cryptocurrencies. The tampered NSIS installer file, "Super-Mario-Bros.exe," contains three executables: the legitimate Super Mario application, as well as the malicious executables "java.exe" and "atom.exe." When executed, the installer drops and launches the legitimate executable, while the XMR miner and SupremeBot run in the background. The malware connects to a mining server, gathers system information, establishes a connection to a command-and-control server, and retrieves an info-stealing executable that loads Umbral Stealer into memory.

Umbral Stealer can capture screenshots, retrieve passwords and cookies, capture webcam images, obtain session files from messaging platforms, collect data from gaming platforms and gather files related to cryptocurrency wallets.

The AI-powered behavioral detection capabilities in Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) identify and block malware before its execution, keeping endpoints and data safe from threats.

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)