https://github.com/mmbi18/tma1del2oti
If there are many files and you can’t delete shell files with a specific format, use my plugin. If the hacker develops, I will develop this plugin at all.
But Ninja Scanner and Ninja Firewall plugins can also help.
After hacking the password of the database and many users, the hacker may create many applications, delete them, change the password of the database and check the cron job and delete it.