you can check for linux unknown users with ssh access, or change your ssh password and reinstall the compromised packages. If you have programs like ps or other tools changed to work incorrectly, then you will probably have to reinstall them or as a last resort, reinstall the server. If your installation is in Docker perhaps the repair would be faster