2Shade_Ransomware_IOCs_06-02-2019

#Shade #Troldesh #Ransomware #Opendir #AdminPanel
-------------------------------
06-02-2019			IOC's
-------------------------------
Main object- "66cc60f6b4a36fc49e14058fdc50614b288467f9ea40b714f2c55bcced08c6fb.bin.gz"
	sha256	7375b87307dd09116edb9f9a61a8e6f69fc02c9ecbd9db4913b120eef909c8d7
	sha1	7a8f7f702b48d8e66653e059e044cc15552fb57c
	md5	8e92999b51a1e0a51e842f0204bb7bf7
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\messg[1].jpg	f8f4de2f06c6c00b170ed88b4ed8d68dd01b48745f70ffce38407b82ae05c0e7
	sha256	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.7_1\_locales\it\PyFxTcv3mJ5gVRfxLMMSAPurth2TIYRsYAF0j-hHDvk=.906D0F2E2F604F839E04.crypted000007	3b41720c4ca11e190808994bfed1ae62a0306bace2dd4c0e9b092ce3ab90227a
DNS requests
	domain	bergras.ru
	domain	www.ri-photo.com
	domain	whatismyipaddress.com
	domain	whatsmyip.net
Connections
	ip	91.218.228.154
	ip	208.113.155.199
	ip	194.109.206.212
	ip	217.234.213.193
	ip	86.59.21.38
	ip	188.118.198.244
	ip	193.23.244.244
	ip	77.68.11.42
	ip	104.16.155.36
	ip	104.18.34.131
	ip	104.16.154.36
HTTP/HTTPS requests
	url	http://www.ri-photo.com/wp-content/themes/asteria-lite/css/messg.jpg
	url	http://bergras.ru/profiles/default/translations/dixi.grup.zakaz.zip
	url	http://whatismyipaddress.com/
	url	http://www.ri-photo.com/favicon.ico
	url	http://whatsmyip.net/
	url	http://www.ri-photo.com/wp-content/themes/asteria-lite/css/common_config.php
	url	http://www.ri-photo.com/wp-content/themes/asteria-lite/css/system_m.php
	url	http://www.ri-photo.com/wp-content/themes/asteria-lite/css/admin.css
	url	http://www.ri-photo.com/wp-content/themes/asteria-lite/css/menu_settings.php
	url	http://www.ri-photo.com/wp-content/themes/asteria-lite/
	url	http://www.ri-photo.com/wp-content/themes/asteria-lite/css/
	url	http://www.ri-photo.com/wp-content/
	url	http://www.ri-photo.com/wp-content/themes/asteria-lite/css/engine_functions.php
	url	http://www.ri-photo.com/wp-content/themes/asteria-lite/css/tick.png
--------------------------------------------------
ADMIN PANEL --> http://www.ri-photo.com/wp-content/themes/asteria-lite/css/engine_functions.php