Vawtrak (aka Tepfer), most of them seem to be active:
Some of these domains are associated with the email address email@example.com.
You could block the sites individually, but because the sites are not isolated, I would personally recommend using the following blocklist:
The 22.214.171.124/24 range is allocted to "Cherepanova" in Russia. 126.96.36.199/27 is Redstation in the UK.