Suddenly a lot of outgoing traffic. How to find the reason?

Question

Malware

On a CentOS 6.5 server

Answer 1

If, as a result of brute force, a login and password were selected and the system was logged in, especially with super user rights, then the system could be used as a platform for further attacks on any host, sending spam, and anything else, especially with root logs could also be cleaned with access.
Alternatively, if there is a backup, then expand it.
Well, change the standard port of the ssh server and set a limit on the number of authorization attempts for a certain period of time.

Answer 2

clarified the question

Answer 3