Couldn’t actually track the link that was spreading them but found the binary.
Its located here:
hxxp://rghost.net/57996578
Why Not detected by avast:
https://www.virustotal.com/en/file/d77dbe40a7c865a0e53ec241d627330e378819ed1c604433a4f0cc853e52cedc/analysis/1410847917/
reported to virus AT avast DOT com