Resolved kankarmz.ru to 22.214.171.124
Gate file: /Duf67/H8938_827.php
Alternate domains (both are currently unregistered):
This is one of only three or so betabots that I have seen rename the gate file from order.php to something less obvious. I guess that might be a bit too advanced for the average HF skid.
Hosting infos: http://whois.domaintools.com/126.96.36.199
Related md5s (search on malwr.com to download samples):