I am not sure if I've been hacked or not.
I tried to log in through SSH and it wouldn't accept my password. Root login is disabled so I went to rescue and turned root login on and was able to log in as root. As root, I tried to change the password of the affected account with the same password with which I had tried to log in before,
passwd replied with "password unchanged". I then changed the password to something else and was able to log in, then changed the password back to the original password and I was again able to log in.
auth.log for password changes but didn't find anything useful.
I also scanned for viruses and rootkits and the server returned this:
"/bin/busybox Unix.Trojan.Mirai-5607459-1 FOUND"
"/usr/bin/lwp-request Warning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: a /usr/bin/perl -w script, ASCII text executable Warning: Suspicious file types found in /dev:"
It should be noted that my server isn't widely known. I have also changed the SSH port and enabled 2-step verification.
I am worred I got hacked and someone is trying to fool me, "everything is fine don't worry about it".