Resolved google-analystic-356.org to 18.104.22.168
Gate file: Not sure how carperb works for this, it seems to just post to random strings with random filetypes. You can see those here
Neither of these has been registered yet, register them, ddos the others and steal some bots today. (won’t actually work, carperb has encrypted commands)
Sample available at hxxp://google-analystic-356.org/aaa.exe
Uploaded here for when they take it down.
Hosting infos: http://whois.domaintools.com/22.214.171.124