Find malicious or hacked file in linux

First find the outgoing connections with the following command

netstat -nputwN

Check the connections and find the connection which is trying to attack the other systems. For example PID 11009 in this scenario.

Use the following command to identify the list of files involved in the process execution

lsof -p 11009

Wordpress image upload http error on Nginx

This was due to the following param in Nginx.conf under http section, Just change it to maximum size of you want to upload 

example

client_max_body_size 5M;