Resolved srv1.su to 18.104.22.168
Gate file: /b/order.php
Everyone should congratulate snk, who has taken his first baby steps into the 21st century by using a http bot. Unfortunately for him he chose to use the l33t Hackforums bot Betabot with a 1mb stub Autoit crypter, but I guess he can only manage to take this one step at a time.
Related md5s (search on malwr.com to download the samples):
Hosting infos: http://whois.domaintools.com/22.214.171.124