URLs and sub domains distributing the malware or acting as a redirector:
Domain andws.com.br is at: 187.45.180.6 (brasil-rbr10.dizinc.com)