[willstrafach]

Those who have examined the publicly available malware samples have stated this address as the only one used at the moment. It is certainly possible that an upgraded variant may use others though.