This is the http loader for the gold installs ppi program.
Resolved planetstat2324.su to 178.255.43.67
Server: planetstat2324.su
Gate file: /gamenew/index.php
Downloads files from ap2producoes.com/images/
minsabdedf.exe bitcoin miner
pool info: http://hernyoooo@ymail.com:Bazdmeg1@pool.50btc.com:8332
ginamdasm.exe
The file botnet owners are given installs smoke from hxxp://oroihfdbbnennm.in/update/0pdat3.exe
Install statistics are then recorded by oroihfdbbnennm.in/activation.php
Using the format
activation.php?productid=(userid)&serial=(long string)
Hosting infos: http://whois.domaintools.com/178.255.43.67
The owner had some trouble with the coder of his crypter: http://pastebin.com/M1qbs24x