Ursnif IOC

Dropping URLs:
http://gjdstephan13aa.com/sywo/fgoow.php?l=gihas[1-11].gxl
http://pkzlionorberto.com/sywo/fgoow.php?l=gihas[1-11].gxl
http://ttoneylii.net/sywo/fgoow.php?l=jylah[1-11].gxl
http://h41iiellie65.net/sywo/fgoow.php?l=jylah[1-11].gxl

IPs:
109.196.164.79
23.106.125.24
23.106.125.239
45.129.2.110
85.143.223.225

Samples:
https://app.any.run/tasks/a9bd3c93-3a09-410d-97a4-d9f1d0f28f91
https://app.any.run/tasks/10dbc8c9-c8d2-405f-a5fb-427f6b145a09/

Update - was able to get working C2:
prnaajm83[.]club
23.106.125.241