@dimchik, You were right. It is an infection.
I am unable to say whether its on first stage or not. I am on Amazon Linux (4.9.20) with nginx 1.9 + php 7.0 + mysql 5.5
The infection didn’t proceed to infect other sites hosted in same host. about 10 wordpress sites.
I do not see similar infection codes.
@generalan, after I replaced things. Everything was fine and normal. I had a “grep” search.