K.php - a RestApps malicious script

[ashcortech]

@johnoneszeros

I don’t know much about iptables, but putting 37.49.230.74 in the blacklist of the firewall doesn’t seem to stop outbound connections to the hackers server.
Can anyone post the rules needed to stop the script connecting? I can see the outbound connections keep happening using Netstat.

if you edit /var/www/html/admin/modules/freepbx_ha/licence.php and remove all the commands except the delete users command. then save it an delete the line from the root crontab and asterisk crontab and it should stop the cycle…