Resolved genhagroup.com to 74.220.199.26
When this site first got posted I though it was hacked, but now that I’ve taken a closer look it’s actually a lame spreading attempt.
Zeus
Server: genhagroup.com
Gate file: /data/gate.php
Config file: /data/cf.bin
The zeus binary was hosted at utmeg.com, as a “resume creator”
The download page warns that it needs .NET 2.0, so the skid is obviously using a HF crypter.
The same download page is on genhagroup but it’s missing the file.
Hosting infos: http://whois.domaintools.com/74.220.199.26
EDIT: lol https://zeustracker.abuse.ch/monitor.php?host=genhagroup.com