Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://lorvu.com/

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    https://lorvu.com/

  • Sample

    241009-1vs61averl

Score
10/10
lummadiscoveryexecutionpersistencestealer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://annoyingfiler.com/requested/kb4.txt

Extracted

Family

lumma

C2

https://drawwyobstacw.sbs

https://condifendteu.sbs

https://ehticsprocw.sbs

https://vennurviot.sbs

https://resinedyw.sbs

https://enlargkiw.sbs

https://allocatinow.sbs

https://mathcucom.sbs

Targets

    • Target

      https://lorvu.com/

    Score
    10/10
    lummadiscoveryexecutionpersistencestealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks