~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed 's/[][]//g'|sort -u|grep -f exits -c
  191
    ~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed 's/[][]//g'|sort -u|wc -l           
  876

At least 191 of the IOC IPs are (probably random) Tor exit nodes :) The actual number may very well be higher, I just grabbed current exit node list from https://check.torproject.org/exit-addresses

Here's the PHP backdoor the YARA rule is for http://sprunge.us/ReFg I'll probably put up the rest of the samples in a sec.

Edit: Here, I uploaded most of the samples listed in the csv http://www.filedropper.com/samples_5

Edit 2: The obfuscation used in the russian PHP shells looked awfully familiar, I think the shell they're using could very well be this one http://profexer.name/pas/download.php originally shared on a .ru hacker forum.