There should be something in the server that was used to maintain persistence.

Can you track this one and find more information about the attacker?

Flag format:

flag{string}