{"id":851,"date":"2023-06-26T15:16:28","date_gmt":"2023-06-26T15:16:28","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/piratske-verzije-popularne-igre-super-mario-mogu-skrivati-zlonamjerni-kod\/"},"modified":"2026-11-04T08:52:32","modified_gmt":"2026-11-04T08:52:32","slug":"piratske-verzije-popularne-igre-super-mario-mogu-skrivati-zlonamjerni-kod","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/upozorenja\/piratske-verzije-popularne-igre-super-mario-mogu-skrivati-zlonamjerni-kod\/","title":{"rendered":"Piratske verzije popularne igre Super Mario, mogu skrivati zlonamjerni k\u00f4d"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Skrivanje zlonamjernog k\u00f4da unutar legitimnih programa popularna je taktika kriminalnih aktera. Tako su hakeri odlu\u010dili sakriti <strong>zlonamjerni k\u00f4d za rudarenje kripto valuta unutar instalacijskog paketa popularne video igre Super Mario 3: Mario Forever.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ova besplatna verzija ra\u010dunalne igre preuzeta je vi\u0161e od milijun puta. Pobudila je nostalgiju me\u0111u igra\u010dima jer je zadr\u017eala mehaniku starije verzije, ali uz pobolj\u0161anu grafiku.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Zlonamjerni akteri iskoristili su ovu priliku i kreirali zlonamjernu <strong>.<em>zip<\/em> datoteku koja osim datoteke igrice sadr\u017ei i datoteke za pokretanje programa za rudarenje kripto valuta.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Trojanska verzija \u0161irila se putem ogla\u0161avanja na dru\u0161tvenim mre\u017eama, forumima, iskori\u0161tavanjem SEO optimizacije za bolje rangiranje u rezultatima pretrage i sl.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Preuzeta arhiva sadr\u017ei tri datoteke: legitimnu Super Mario 3 datoteku (\"super-mario-forever-v702e.exe\") te <em>java.exe i atom.exe<\/em> datoteke koje se automatski instaliraju na ra\u010dunalo korisnika prilikom instalacije igrice.<\/strong><\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af19ec6a387e&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af19ec6a387e\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/06\/image-1.png\" alt=\"\" class=\"wp-image-110930\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption><strong>Izvor: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/trojanized-super-mario-game-used-to-install-windows-malware\/\">bleepingcomputer.com<\/a><\/strong><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Napada\u010di znaju da igra\u010di ra\u010dunalnih igara posjeduju sna\u017enija ra\u010dunala, a ona su prikladnija za rudarenje kripto valuta zbog mogu\u0107nosti obrade velikih koli\u010dina podataka.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u201eJava.exe<\/strong>\u201c datoteka slu\u017ei kao XMR program za rudarenje Monero kripto valute, a <strong>\u201eatom.exe\u201c<\/strong> slu\u017ei za uspostavljanje veze sa zara\u017eenim ra\u010dunalnom, kako bi napada\u010d mogao upravljati procesom rudarenja.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">XMR program za rudarenje radi kao pozadinski proces bez znanja i pristanka korisnika te tako koristi \u017ertvine resurse. Osim rudarenja kripto valuta, program skuplja podatke kao \u0161to su naziv ra\u010dunala, korisni\u010dko ime, podatke o procesoru i grafi\u010dkoj kartici te dr.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Atom.exe stvara svoj duplikat unutar skrivene mape u direktoriju igre, a zatim stvara zadatak koji se pokre\u0107e svakih 15 minuta, a skriven je pod imenom legitimnog procesa.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Apeliramo na gra\u0111ane da datoteke preuzimaju samo iz provjerenih i slu\u017ebenih izvora, a sumnjive datoteke provjere antivirusnim programom.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vi\u0161e o ovoj kampanji pro\u010ditajte na <a href=\"https:\/\/blog.cyble.com\/2023\/06\/23\/trojanized-super-mario-game-installer-spreads-supremebot-malware\/\">https:\/\/blog.cyble.com\/2023\/06\/23\/trojanized-super-mario-game-installer-spreads-supremebot-malware\/<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Skrivanje zlonamjernog k\u00f4da unutar legitimnih programa popularna je taktika kriminalnih aktera. Tako su hakeri odlu\u010dili sakriti zlonamjerni k\u00f4d za rudarenje kripto valuta unutar instalacijskog paketa popularne video igre Super Mario 3: Mario Forever. Ova besplatna verzija ra\u010dunalne igre preuzeta je vi\u0161e od milijun puta. Pobudila je nostalgiju me\u0111u igra\u010dima jer je zadr\u017eala mehaniku starije verzije, [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1343,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[23],"tags":[],"tema":[],"class_list":["post-851","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-upozorenja"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=851"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/851\/revisions"}],"predecessor-version":[{"id":1347,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/851\/revisions\/1347"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1343"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=851"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=851"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}