193.178.159[.]128IP address
Reported by 2 independent sources · first reported by The Hacker News · last reported
Last reported 28 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials“Upon execution, LunexStealer communicates with the Lunex panel at 193.178.159[.]128 over HTTP to facilitate comprehensive information theft -”
-
ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer“A later-stage sign is traffic to 193.178.159[.]128:8080, particularly requests to /api/v1/agent/ and /api/v1/ext/ with an X-API-Key header.”
-
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer“The panel, which is distinct from the implant's C2 ("193.178.159[.]128:8080"), is used to configure web-lure commands and records interactions.”
Indicators reported together
named in the same reports- uasputnik[.]comin 2 reports
- account-sams-club[.]comin 1 report
- teamwork-recover-password[.]comin 1 report
- namshi-uae[.]comin 1 report
- whatsappbusineses[.]comin 1 report
- ibraq-perfumes[.]comin 1 report
- fsputnik[.]comin 1 report
- 107.175.82[.]242in 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2023-20598
Thanks — we review every report.