I pasted a gist of the backdoor script the hacker downloaded onto that server: https://gist.github.com/anonymous/8527149

Original URL is http://pdd-nos.info/.tmp/back.conn.txt