MALWARE-CNC Win.Trojan.Gh0st variant outbound connection

[d@rkNit3_76]

Can someone assist me in finding IoC on host system related to this particular IPS event.  I read somewhere that they could be false positive events linked to device that perform some security related function. Traffic source is from Shodan (66.250.205.34) reported by Firepower ASA.

External Reference to IPS event:

https://www.volexity.com/blog/2017/03/23/have-you-been-haunted-by-the-gh0st-rat-today/

[rick11]

I was curious if you find a solution....