http://{blocked}aeye.ru/bin/ko ethood.bin

This is the site where TROJ_ZBOT.WAY downloads its configuration file. This configuratition file contains where it downloads an updated copy of itself, list of tar