Resolved toxhoster.net to 80.82.79.35
Server: toxhoster.net
Gate file: /forum/gate.php
Some idiot set it to download itself from the server, so it will run in an endless loop of stealing passwords, sending logs, and then downloading and running itself.
Hosting infos: http://whois.domaintools.com/80.82.79.35
Related md5s (search on malwr.com to download the samples):
b22258989a5e93d4cb1c3960441c1c06