Shade_Ransomware_IOCs_23-01-2019

#Shade #Troldesh #Ransomware #Trojan
---------------------------------------
23-01-2019				IOC's
---------------------------------------
Main object- "1d517bc28ca11eacadcdd3ab2ba0aaf167ac47541978d960c558e7496953c411.bin.gz"
	sha256	6406ff02c1529d291f9339450eceac0d39e56e0c085df495a0c6eb6a316246a6
	sha1	c0dc482fddfc4b1a8f43dbcb53b99eb584e32241
	md5	528e0db66dee478425f40908e6941910
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\ssj[1].jpg	12352cb3fcd048e8b8dc1efe47e0a70456e1ef9d17724201dcfe70ad500c39b2
DNS requests
	domain	tienlambds.com
	domain	greenglobal.co.id
	domain	whatismyipaddress.com
	domain	whatsmyip.net
Connections
	ip	203.113.172.116
	ip	202.52.147.118
	ip	104.16.18.96
	ip	104.18.35.131
	ip	128.31.0.39
	ip	131.188.40.189
	ip	95.216.138.138
	ip	76.73.17.194
	ip	66.223.151.183
	ip	85.214.212.153
HTTP/HTTPS requests
	url	http://greenglobal.co.id/wp-content/themes/avik/avik-functionality-plugin/ssj.jpg
	url	http://whatismyipaddress.com/
	url	http://whatsmyip.net/
---------------------------------------
Main object- "81cf49092a72f280e619fc4087d8073909dbaf278836aacb49c00335fc338334.bin.gz"
	sha256	fb22b18185c7203b3a4847dd66ffc59e47ee40a1735dd102dcc947d6633210c1
	sha1	dd18dedc8a255435c112037cdfc480f7e7a76926
	md5	1a0afbd38bc7337eea22326ead41d50e
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mxr[1].pdf	c0c4b90379ef98aa9a6d4f62106a17e4492ef7bfbe4446270f11c713c2b76da9
	sha256	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\it\ZHmgMkWK6QYp2c5oPwYLfw1ipFCGcUar35XRTJV8SKw=.906D0F2E2F604F839E04.crypted000007	a0877fbe5ad0d755e23715f27222dcf98eab51c9d224dac6ecac1ac9aab4813f
DNS requests
	domain	artburo.moscow
	domain	whatismyipaddress.com
	domain	whatsmyip.net
Connections
	ip	104.16.16.96
	ip	195.133.197.67
	ip	76.73.17.194
	ip	51.255.206.74
	ip	193.234.15.62
	ip	88.198.17.143
	ip	104.18.34.131
	ip	81.7.18.97
	ip	128.31.0.39
	ip	86.59.21.38
HTTP/HTTPS requests
	url	http://whatismyipaddress.com/
	url	http://whatsmyip.net/