I've contacted oxwall directly, still waiting on a response.

Apparently theres a security whole in a php script which allows hackers to run there command from shell access as nobody.

This is the command which is covering up whatever there running
/usr/local/apache/bin/httpd -k start -DSSL

This is the document explaining everything
http://help.ovh.co.uk/HackedMachineExample