It has to be something related to home folder of root. I just found out that it happens only within root folder (/root). If I escape it and send 'ls' command text stays black as it should.
I had one script with some color strings in /root. I removed all scripts from this folder and it still shows green text.