Azorult

Azorult and some stealer domains(some might still be staging and not actively involved in campaign yet):
avecaesar.info
softinstallloader.icu
setupmyinstall.icu
7wereareyou.icu
getmyforestguard.icu
4wereareyou.icu
3wereareyou.icu
azorrtraffic2.icu
4wereareyou.icu
5wereareyou.icu
trafficday2.icu
9wereareyou.icu
8wereareyou.icu
6wereareyou.icu

Urls:
http://4wereareyou.icu/de/2[.]exe
http://4wereareyou.icu/us/1[.]exe
http://3wereareyou.icu/postbackusa/1[.]exe
http://3wereareyou.icu/postbackusa/2[.]exe
http://7wereareyou.icu/index[.]php
http://trafficday2.icu/index[.]php
http://azorrtraffic2.icu/index[.]php
http://avecaesar[.]info/legion17/welcome

IPs:
35.246.139.134
31.184.254.68
185.206.146.73