Malware analysis

You're given an archive that contains the directory structure of a web-server running on Linux. You have to examine the contents of the archive, detect the malware and understand what it is doing.
Document your findings by including file fragments, code samples or screenshots.
Let the questionnaire below guide your research.
Devise a set of recommendations for web-site owners, to help them avoid getting hacked.

Which attack vector was leveraged to make the hack possible?
Why did the attacker obfuscate the malware?
What obfuscation techniques were employed?
Why did the malware not leave any visible traces on the front-end?
What could have been the motivation of the attacker?
How did the attacker ensure that only they could access the malware on the site after it got pwned?
What would be an easy way to identify malicious files in a web-application?
How to find other web-sites that were compromised using the same technique?
How can you find out the attacker's password?
Use of certain functions in the code of a web application is possibly a recipe for a disaster - which functions are those?
How can you catch the attacker?
What methods are employed by the attacker to ensure the malware stays there after you remove the malicious files?
What mistakes committed by the site owner made the attacker's job easier?

Nothing specific here, use whatever you want. You might need:

a directory and file comparison tool
Far or Midnight commander, or anything that can search for a specific string inside a number of files
command line skills

And anything between that, as a function of how many questions you've handled.

Contents