Is VDS sending spam?

Question

System administration

Today VDS on hetzner began to behave strangely, abuse letters began to arrive with complaints about spam from technical support, and the top command gives the following picture:

Answer 1

You were scammed, take a new vps and configure everything from scratch, I would not risk leaving the vps where the attacker got the root. It is too easy to leave a little hello in the system with such rights, and without comparing all files with the originals, such a hello cannot be found.

Answer 2

ls -l /proc/<PID>/exe

find where this ssh is (most likely somewhere in / tmp)
then analyze the logs, etc. how did he get there,
but it’s better to rearrange the system, because the villain gained root access and it is not known what and where he could replace

Answer 3

Logs are empty in /var/logs/mail.log and other files are empty. Open via vi or mcedit, debian system

Answer 4

Logs in /dev/null not redirected by link?
is there rkhunter?

Answer 5

Thank you, everything is clear.