Shade_Ransomware_IOCs_04-03-2019

#Shade #Troldesh #Ransomware #Trojan
-----------------------------------------
04-03-2019					IOC's
-----------------------------------------
Main object- "a004acd1f73ab1d9b3b7cfb775eedafeaaf353749aeb5f6b2b9397c52db46f87.bin.gz"
	sha256	dce8045e318cb0989599bb9d8403f63546cc89d3c55ee514265071128329e0a9
	sha1	f12f044049690b6ab7fe96a1ecb9e0056013cef4
	md5	4d5e94d891ad8062a310e7f9afe8bc06
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\msg[1].jpg	a1271c366e91dbc3a7f0d6b4b2c1873019056786219c14ad12185ad115771632
DNS requests
	domain	motorlineuk.co.uk
	domain	tb.ostroleka.pl
	domain	whatismyipaddress.com
	domain	whatsmyip.net
Connections
	ip	212.42.180.221
	ip	62.129.198.194
	ip	76.73.17.194
	ip	86.59.21.38
	ip	208.83.223.34
	ip	80.127.152.30
	ip	104.16.154.36
	ip	199.115.114.70
	ip	131.188.40.189
	ip	68.129.30.236
	ip	104.18.34.131
	ip	195.138.255.24
HTTP/HTTPS requests
	url	http://tb.ostroleka.pl/templates/siteground12/css/msg.jpg
	url	http://whatismyipaddress.com/
	url	http://whatsmyip.net/
----------------------------------------
Main object- "a1271c366e91dbc3a7f0d6b4b2c1873019056786219c14ad12185ad115771632.bin.gz"
	sha256	af33eb6f7534e21a4cdd2846dfc64b0feb6de92e0dc5e245fda1d3e3b9c88b7f
	sha1	15b368152cfefb7642816441c8a07082bcbcbf87
	md5	adfc1e1dbf415a0e5c8a5134f81fb1e7
Dropped executable file
	sha256	C:\Users\admin\Desktop\a1271c366e91dbc3a7f0d6b4b2c1873019056786219c14ad12185ad115771632.bin.gz	a1271c366e91dbc3a7f0d6b4b2c1873019056786219c14ad12185ad115771632
DNS requests
	domain	whatismyipaddress.com
	domain	whatsmyip.net
Connections
	ip	86.59.21.38
	ip	128.31.0.39
	ip	76.73.17.194
	ip	78.46.60.40
	ip	104.16.155.36
	ip	51.15.123.75
	ip	95.141.35.15
	ip	104.18.35.131
HTTP/HTTPS requests
	url	http://whatismyipaddress.com/
	url	http://whatsmyip.net/