Return to Answer

you can check general access log, nginx/apache, some connections you can see there.

or

configure auditctl to log:

auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

then check whats going on:

ausearch -k mage_malware | aureport -f -i


File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771

actually you can try to use this scanner, just to quickly find malware:

https://github.com/gwillem/magento-malware-scanner/blob/master/docs/usage.md

Using Debian/Ubuntu
# Install prerequisites on Debian/Ubuntu flavoured server
sudo apt install -qy python-pip gcc python-dev
sudo pip install --no-cache-dir --upgrade mwscan
Using CentOS
# If you don't have EPEL yet, for CentOS 6:
wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
sudo rpm -ivh epel-release-latest-6.noarch.rpm

# CentOS 6 only:
sudo easy_install --upgrade requests

# All CentOS: 
sudo yum -y install python-pip python-devel gcc
sudo pip install --no-cache-dir --upgrade mwscan 

you can check general access log, nginx/apache, some connections you can see there.

or

configure auditctl to log:

auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

then check whats going on:

ausearch -k mage_malware | aureport -f -i


File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771

you can check general access log, nginx/apache.

configure auditctl to log:

auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

then check whats going on:

ausearch -k mage_malware | aureport -f -i


File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771

you can check general access log, nginx/apache, some connections you can see there.

or

configure auditctl to log:

auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

then check whats going on:

ausearch -k mage_malware | aureport -f -i


File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771

you can check general access log, nginx/apache.

or setup inotifywait trigger:

#!/bin/sh
while inotifywait -e modify /home/magento/app/Mage.php; do
 kdialog --msgbox "ALARM - FILE WAS MODIFIED!"
done

or configure auditctl to log:

auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

then check whats going on:

ausearch -k mage_malware | aureport -f -i


File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771

you can check general access log, nginx/apache.

configure auditctl to log:

auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

then check whats going on:

ausearch -k mage_malware | aureport -f -i


File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771