I'm looking at the URL tail alone...
/wp-content/plugins/scure-bank/fea7b6cabec2fd724dd2d1b4ca7e898d/thankyou.php
and it seems that banking scripts were probably installed in the scure-bank folder.
ClosetNoc has good suggestions, but first I'd suggest downloading any content you believe is good from the server to your computer to keep as backup so that when you do a whole website restoration, you can upload any important content back that may have disappeared during the restoration process.
If you can, download all the server logs and see what logs show entries related to any portion of the URL you mentioned. Then take note of the IP address and block it, or better yet, block the group the IP address is in. The group can be found by doing a whois search on the IP. At least that way, the restoration process can be done a little easier and maybe faster.
Once everything is restored, take Closetnoc's advice and set completely new passwords.
If you use a MySQL database server, try to set it up so that only connections can be done from the same server instead of from the outside world. See the skip-networking setting. It can be applied to the configuration file.
https://dev.mysql.com/doc/refman/5.0/en/server-options.html#option_mysqld_skip-networking
Also, use only the least amount of outbound ports required for everything to function properly before the phishing attack. Definitely keep port 80 open as it is standard for websites.
As for other ports, if you assign new numbers instead of standard numbers and you have client software that can connect with new port numbers, then that's all the better since it gives hackers a much harder time.
And for secure shell access (if you have it), try to make it a two-step login procedure for root access (meaning guest has to login to another account first in order to access root).
And lastly, make sure you're using a good secure network, not one that hackers can sniff data from.