Resolved genhagroup.com to 74.220.199.26
This looks like it’s hosted on a hacked server
Server: genhagroup.com
Gate file: /andro/image.php
Plugins
Rootkit: genhagroup.com/andro/r.pack
Socks: genhagroup.com/andro/s.pack
Formgrabber: genhagroup.com/andro/f.pack
Gate file: genhagroup.com/andro/fg.php
Hosting infos: http://whois.domaintools.com/74.220.199.26