Malspam IOC Vidar/Formbook/RAT

Vidar:
539ea5c81bccf7f2a16752fe86ded3d03b9ec8300e62cadedf344ba3770beee3
Dlls and C2:
pineloseesrae.com
ec3ba459cf6deeb2ae8f5b30d7398efc3b967aeb71a09d49bd8940e7b5e848a1
Dlls and C2:
qubert.org
923d3a0b9bcb401b97a7f929974e53552e69afde105b21bc009e6028c677d7fb
Dlls and C2:
martinlloyd.net
b00195d06350161758241dd77bbff9c8fd9ae927b1455c9ac31b36df5e3e7ad9
Dlls and C2:
acrelop.com

Formbook:
8b3646a6fae8ef9a321a01ac49652249a69a1595a0ed635f8dd27a9fcb7be762
Post infection traffic:
http://www.imizin[.]review:80/ht/?1bwh8=7pldAwvXetMhNAR2gcPRIJ7EtBvFu4JoWNbHSRbUXyAk5uj+ZMqeb+o+TVPXxsdVY5nzPiBumdKJWNkK0he2Eg==&tD=ktgtUVBX2Fs
http://www.xn--oru96d1wax98e[.]net:80/ht/?1bwh8=hhvLAUKwkOFrxsPhG4PF4u/ZpNvWgfDIQy2aJKSzQzDtuvzH+tmQOSZUub9vhrzVdXX4M//5HpsNUhcg+bjAgg==&tD=ktgtUVBX2Fs
http://www.xn--oru96d1wax98e[.]net:80/ht/
http://www.3hilltopstudio[.]com:80/ht/?1bwh8=e10sYPf8iTYGju81K+Q+tJQAYIRS/yHCA5YzmQLYrFpws1NgYqM6tzBQfRiC2kQWS1muPtIHsd7iihvNKDGJxw==&tD=ktgtUVBX2Fs
http://www.3hilltopstudio[.]com:80/ht/
http://www.hottennisjp[.]win:80/ht/?1bwh8=oOX69p5TlovnOG+8CgAnFvERHHq2ds38gF070XN3bWxhdc2gf5zR/FEaYe7t5mrx4Z1s/RallUCvOjtmc8TLaw==&tD=ktgtUVBX2Fs
http://www.hottennisjp[.]win:80/ht/
http://www.bgtr[.]cymru:80/ht/?1bwh8=2/c56CH46ZV6WuFu47iZGPntdwWHVfF4Eqj3z1da7P2POo/wHoXEe8aXB1GqouETf+WSwE8LDG2YyGJDm1/59Q==&tD=ktgtUVBX2Fs
http://www.bgtr[.]cymru:80/ht/
http://www.regiusgames[.]com:80/ht/?1bwh8=RjFRQaur+tzcEQrgL86FkJoje2+dysYX8pVDDw70zK2HWAy30XqzSbitRqLi0w45rTDaFQLSKSQUG7ncqQyU9Q==&tD=ktgtUVBX2Fs
http://www.regiusgames[.]com:80/ht/
http://www.tweakboxapp[.]info:80/ht/?1bwh8=xbBTjUfkX04VhELMKxqYypxmJfgBvBzaeLNZiQ9GUnipB7oxu7s6WBNELluvCzRUe7uNEMmD0ZCXE/DNcb68cw==&tD=ktgtUVBX2Fs
http://www.tweakboxapp[.]info:80/ht/
http://www.facetheday[.]net:80/ht/?1bwh8=vE0ziyL3VEX47D9zfZa2I3TAMxMekajm8GZcln9ov4QprkiDRiPxpr6N4fogPVg/Bxm5ZlR3sScKvRfoTBgzkA==&tD=ktgtUVBX2Fs
http://www.facetheday[.]net:80/ht/
http://www.gmopets[.]com:80/ht/?1bwh8=Mpj1uBaZEIa4ai8Vr2fhDXNXXZlL4V2rYETxekkALiEnpiWtf8jJJPdTlVIA+029swfR9qakrevrKz1dARs0kA==&tD=ktgtUVBX2Fs
http://www.gmopets[.]com:80/ht/
http://www.mnuvmg[.]info:80/ht/?1bwh8=IESSHaKcl+82RMOP53MCi4mp7TiEvlnGJx2cFy4YknHdID+vRnYI/MViVBkTuDIXcd3jkBFi/Zq50JOuI83evg==&tD=ktgtUVBX2Fs
http://www.mnuvmg[.]info:80/ht/

Some RAT:
ce887f9ba8bed67d81254fefb1e27517ca2aa835f7992b813aed4677cac177ca
C2:
masked101.duckdns.org