README.md

Diabolic Ladybug

Diabolic Ladybug, also known as TA505, is a financially motivated cybercriminal group active since at least 2014, known for orchestrating large-scale malicious email campaigns to distribute various malware families. They have deployed banking Trojans like Dridex and TrickBot, ransomware such as Locky and Clop, and remote access Trojans including FlawedAmmyy and SDBbot.

• The full report is available here

Diabolic Ladybug Group Indicators of Compromise (IOC)

Diabolic Ladybug Domains

aasfhhvyyayssa.xyz
aasouv636d.cn
afggaiir3a.xyz
aisiciciaisxuusuxic.xyz
aonvjvisi3949vnao30cv.xyz
aosdnvnauurt.xyz
asdijoisad87ay3.cn
asdyyauscuauusc.xyz
asfggagsa3.xyz
asfjjasguasus.xyz
asfjjsdvv33gqrr2fv.cn
asfpihbhbyd.xyz
asfuuvhv3083f.xyz
asgyyya6ychcha.xyz
asudjasdusad.xyz
dfsrakizimoy34ggf.xyz
dkaknvizisic.xyz
hitnaiguat.xyz
listjhueaa.cn
neboley.cn
novacation.cn
pgf5ga4g4b.cn
pssoduvnzud.xyz
sacmmvivuasd.xyz
sadiviai9d9asd.xyz
sagbbrrww2.cn
sagiai3agar.cn
saidifufaysydas.cn
saidijfjv9as.xyz
saidiviaiisj3.xyz
sasdmvica883fen.xyz
sasf6asf683jfsd.xyz
saudjyyvv663.xyz
sdgububue3.xyz
soajfvhv235ua.xyz
whereihjeu3.xyz
teahgiaj3ig.cn

RDP/Proxy Servers

37.1.201.136
5.61.60.54
23.227.194.159

Management Panels

185.163.45.186
185.163.45.240
185.163.45.248
185.163.45.56
185.163.47.171
185.163.47.210
194.180.174.20
194.180.174.56
206.188.197.203
206.188.197.221
5.181.156.142
5.181.156.15
5.181.156.4
5.181.156.64
94.158.245.113
94.158.245.172
94.158.245.180
94.158.245.73
94.158.245.77

HRDP Tool Hash

SHA256	Domain
66e66cd3ec6f39b483ed7b48ca02a6a4917129f62f800c6033c4f78f2f9282f5	bromide.xyz

ServHelper Hashes

SHA256
a1219acec7d8b85c7b4626536074eeff8db803b50f60e6f87eaa4289b9e4d326
1b3740d9a8511ddfdb657cd796c7bd0adb49bf8f63490df0248ff07d19cd4294
da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605
d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486
4ff1dae2285660a46c356a8e836879adc2999f2044a26d17ac4ce5f9e1b442a3
f771432c3652882bb0a7ddf235648c606f713f6f5baf610358784ffb84be8119
13520de2d217cc8b84b80c9ddf7d63173cb086ef731aecf305aef8cc1822bf7d
f62434d2bfd1b9d953618d0be4ba442e3210b821575ae1b1c97ae6aa55ae394a
86e2c0d8edca2f757546e0a39ad127a765baadd1bdfd4684989c2f48e91191af
345c8cfc9b89b30c742e78d7d57b706a2964d5be97fa95b69f2f3eb58d32db63
7d2e5d0e384590ef4f759d93c19400f2914247774ae95c79f24051f3d2a3008e
1445bf709e6a8d940bad6be531c783b2429132b61998d5797ea818847efa1d7b
5c9d696efa6dc5c89e8aa672cbd94d871876ef7aeb0f59a641ac13db7764363e
8c3488033b80790744702061432620884547c91ea3c4862acb220625eba77024
b075e0ab2910952131b06aee792fed4c97bcdc7f5817112f3035308cd4636c4c
02dcc8523e47914f0ff7f9eb632c0f317960271b4f5161b27e09937deef83b07
87c765c5fce805243bb8c87424235b4fc08fdf0f47517a302dc40583632904d0
97c3090d1be0ac549a065eb7346cbe5052d7c10040f6d44e3cd082f84ded618e
9bb4fdc2f141a11fa7ea8a6e1a6754593d1e85ae29d64d46d72fc8da1dae3bb1
25b987d4f4017e0e97c4b81eeab59c4fcf7832dc48a8e7f12ae5184ccc229937
151f8b796850f46dc292cd7153a68cc7efe4dd694e2164087b42023b4dacc8c3
ceeebe176e8e2d2eccbcb66aa2dd78acbd461d912123114d33526089ae7f2e6f
d541b9ff1fd68818abd9d0f70966e97beaab82dd6bb32d66566fbd6d657fbfd8
6f76d29b00e83d8fef479e9e261e4fe8f98db387c15d8d8bfebbe03b898c0131
64cb280711db0137dc6da7f2cd71745f94ada56d890c6326f07f1b36eee36e07
b32f96217e69b983264075a884c789bbb59b04995f5468c2c6a54d9385d13a80
b2c81b6b95ad45e343ad9376c11c9243f810bd99bb3b8d140eaa4ae2f2444f8c
e04abdb57ce06940bdbac3b5c6a99a7e52e6c315dd97e3da045d570871e7900b
d62856d3faa446b2b0305691aa0a1cb4d03c12e24a6581285a25b15e10b5cc67
3c441477158518c9994e3b42f49278cb0e4f048fcc2648f21f0816cf77187445
a09dcec94458d1970ded54ec374167cd227fea6ff4b56effa1755926d7bd5f41
6f76d29b00e83d8fef479e9e261e4fe8f98db387c15d8d8bfebbe03b898c0131
282e8186cec5ec821d89c7347f508aca3eb1e5c532200d50550e75972e5c33c8
59562b8cc45655a72f7b54e1de28c5585d1d6ccf2963b73d8737ecc2387aeb1b
f0a360fac55b952594568dadd94d7a60d575893fa9258314f098a9e98df45bae
cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3
3db7b97aa0bff0fdde441f01d62d0504c33088314472a3cbbd6bc684dd04697b
1557c247f197086be4a5076f89b88357a9a5ecb7dbb3de2d0cf63eda57a24d7a
6839de9e0b5882b0e6668bc5e68b23923be40efaf2bd3606caf71f66aaf01478
f3b0f09bea01f4577516594f646ab3c05f5829aafad7e42370ed97ac95b5df58
6377077d1743520bec5e8c287d56e6f443cb40201450252a880d5fee7271b151
f3b0f09bea01f4577516594f646ab3c05f5829aafad7e42370ed97ac95b5df58
b5e776f84f8f01fcc1fb822ff5612afe62097bf367ced2187fda0b5bf3d652ee
5911ad0a2f2f76cbe6e83b58b95ac820aee88b7fb37e017275bd3984b3b92bfa
fc3c17833725d727590ef00fdf3f8d70f52d4c13a9cf52a77b6e74e22d7dae61
046f08e500cc9156c4af47a73744ccb060606c77d7a8beb5677aa6ff4d256211
0d8119421ceeffeab9c6bbb649eb52e8d6f0fb049fa0293166af3d65cfa1489e
7fae4ffb43200001f2f16a6a2b23a507370fb692c8fa659d3c335fb7a4002277
c7cb1cc9a2148e8db293de61d791cbbe7202eda89335c93caf454028a61d0a90
353a484824356a70e6d08c5cf637228d2788364199c1bb4b3feca28783378f74
2fd386c26b8a516a4cd864d59df2c74321f3e0436ca4e876a42c4e34f56ae074
08a75beea96e15a6bc2e838cf0649ef0e3be100b819d4513b816778f18903c12
60fc94385520b4353ddc0d9fda9698f4f61ff74abaf794525b9828f8bc24ed0a
c2e0d82381c56792d5dc7d3288bbeb68b53c8d6bfad4c22f33bab9ad5bb848e0
8190afb8cbe829cdf4aca9351e5a772e228a4afcd9f04c55f2e3cd23a2d185ab
a14ccd32d63e5ae6638980c12aaec19aeb86646ac5fc3d0f8fc9042ce11e48af
d8ebd1d13056d7ae44d84ddcf7df37b79940a89918aa7871f36241de65c624ad
3ebf679771812224bfa18e2736116a8e5d811191e0ef5c9639fa853032d52cc0
a2b0ef2413399dbdb01de3a0d2dd310ba127bbfdad09352fecb8444d88a05662
ed29d4ab1988cb5066a313d0d0b08459899ecbd827df42d4e171bad0f3717448
26235babec09882e22c83a2862221c670dd1ca690a76cf1c313842a0c8ae4af3
216f34056b57137d69073604206e30a606188c6c42bdd24d08643266cd631e2a
6a68a6a3ccb8db1621e0655385c566969ff356b5fa6da357d9d098788a32cfa5
9ec2cdb88e31593abc176a5b11c7993d3039444f9dcfd607c1bf1bcc9db939b3
4ff9ad975fec22dd387c910dc163a2cfe3fffe7152b6f97d597ccb936caaab99
11327ae9126f1e924e43dbb06a5e3d158d4d980472f0f2f30f9f73443913776d
7af3f4589a0d13da9f6f09244cd02fca406632e55a02648371978b047bf3647b
5cabe27ecb16899c66c118077e9574191d29671c8136a8274addf6fa1cd103c7
64f1a2f9b95a39c04b60062a24a7bc6de038f706cd679df7b1346c34c055e0b1
0bc24531345dd120b7242992dd2a00429c62535adfd8f69041431ac9ae13793d
c0516809e105193c11ac5913c57c3aacfbfaa98e046bdd8ab9f71c1d555f0534
6e43a01b09534fe3932ebc9d0ea950baeb28bf00cd157b618c8ec4ba6f346c66
9530ff957cd2b657cf8ee3b315636b6ef6124ecc785e9b769618043ed5c561bb
7a58242ae37aab93f74185733ffd30425ca9d2451c83655aa2c07c09b5f40f90
7ed9b5536d19ad840881d068719dbc95da230bf00ba647bf1340bc5666daf2c7
00a8e4ff48e955d37146ea6994812b3bdfecdff356d5fcdd1b23e5aedfb39604
7f6e55013ecda2d56a70b135b412943aec62ba6bf314356b7c518215ce1d7d15
00a8e4ff48e955d37146ea6994812b3bdfecdff356d5fcdd1b23e5aedfb39604
5fd42aaad58f4a1377fd528dbe6010b014b2e922243942ed00df9a8ed7ed33b9
9c1643a07c97b89e8b9fbdf0ea661f98549cfaca9478d1b87ae52eee79e06567
f78d5aecc88c20ad1121ce0b504eb8de51e461e1b3820db07577906649841bdc