URLs and sub domains distributing the malware or acting as a redirector:
Domain lea48ssur.rr.nu is at: 194.28.115.150 (h150-115.net.lan-rybnitsa.com)