Forensic CTF - Bob's Chili Burgers Website Hacked

Link to Download E01 for Case

Setting the Scene:
You're a consultant who has been called in to conduct a forensic investigation for Bob's Chili Burgers LLC. Bob Barnascus, owner of the company, is disturbed by customer reports that their website was infecting customers with malware. The website was just debuted and within an hour customers sent complaints and legal threats. Bob and his executive leadership team of crack Chili experts have asked the below analytic questions to guide your analysis.

Figure 1: Bob's lengthily developed website captures the essence and substance of his well reputed business.

Mounting the Image on SIFT or Kali:

1. Place the image in your /cases directory
2. sudo su   # become root
3. ewfmount /cases/BobsFamousChiliCase_Logical.E01 /mnt/ewf_mount1/ # Mount the E01 as a RAW in /mnt/ewf_mount1/
4. mount -t ext4 -o ro,loop,noexec,noload /mnt/ewf_mount1/ewf1 /mnt/e01 # Mount the RAW in /mnt/e01, use "noload" option to fix filesystem

For more info:
https://digital-forensics.sans.org/blog/2011/11/28/digital-forensic-sifting-mounting-ewf-or-e01-evidence-image-files
https://digital-forensics.sans.org/blog/2011/06/14/digital-forensics-mounting-dirty-ext4-filesystems

Questions:

1. Verify SHA1 Checksum of the image provided:
2. Through what protocol was this system compromised? 
3. What distribution and version is this system?
4. What country is the attacker's IP address from? 
5. What time was the attacker account created in UTC (XX:XX:XX format)?
6. What port is the protocol used to compromise the system set on?
7. How many different countries are represented by the IP's in the web server log?
8. What date and time (directly copy/paste from log) did the attacker first log in?
9. What is the IP that failed to log in directly before the attacker successfully logged in? 
10. What day of the week does the attacker's cron job fire?
11. What is the name of the user account the attacker made?
12. The attacker set a password for the account that they made, what is it set to?
13. The attacker changed the root password, what is it set to?
14. What addition to the website is causing users to get redirected to malicious pages?
15. What exploit kit is the link associated with?
16. What is the sha256 hash of the first file the attacker added to /var/www/html?
17. What is the ClamAV name for the second file the attacker added to /var/www/html?
18. What file was exfiltrated?
19. What command line tool did the attacker use to exfiltrate the file?
20. BONUS: URL for the exfiltrated file?

I hope you enjoy this, it was fun making it!