Resolved srv1.su to 94.242.198.65
Server: srv1.su
Gate file: /b/order.php
Everyone should congratulate snk, who has taken his first baby steps into the 21st century by using a http bot. Unfortunately for him he chose to use the l33t Hackforums bot Betabot with a 1mb stub Autoit crypter, but I guess he can only manage to take this one step at a time.
Related md5s (search on malwr.com to download the samples):
a4bb4fb1f893dedcb91d0bf5c3620aed
Hosting infos: http://whois.domaintools.com/94.242.198.65