In wordpress, a left folder with files appears in the root folder. Where to look for a hole?

Question

Malware

A folder with a random name appears, for example
9243102902f8f092a06bf66e373a36fe16dfd0b6
in it files
remote_query_server.php
.state
.htaccess
.filelist
.fileHalfCheck I
delete it, but the next day it appears again.
Some time later, code is added to the original .htaccess to make it possible to run remote_query_server.php from the outside with parameters.
I tried to scan the WordPress folder with Aibolit - without result.
Changed ftp and wordpress passwords.
Where to look for a hole?

Answer 1

I had a similar problem, try the options indicated in this thread