New answers tagged hacking
unama is definitely not a "normal" file from an official package, see packages.debian.org. You an check whether it comes from any installed unofficial package by running dpkg -S /bin/unama. This will either show the name of the installed package it comes from, or show nothing if this file is not associated with any currently installed package.
Given the location of the files and the ownership I would assume that the attacker got in through a vulnerability in Roundcube and then uploaded the files. The best way to really go around this is to run a stat command on the files (stat movie.avi) and see when the file was actually uploaded. After you get the timestamp, you should check the Apache logs for ...
Top 50 recent answers are included