actually you can try to use this scanner, just to quickly find malware:

https://github.com/gwillem/magento-malware-scanner/blob/master/docs/usage.md

    Using Debian/Ubuntu
    # Install prerequisites on Debian/Ubuntu flavoured server
    sudo apt install -qy python-pip gcc python-dev
    sudo pip install --no-cache-dir --upgrade mwscan
    Using CentOS
    # If you don't have EPEL yet, for CentOS 6:
    wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
    sudo rpm -ivh epel-release-latest-6.noarch.rpm
    
    # CentOS 6 only:
    sudo easy_install --upgrade requests
    
    # All CentOS: 
    sudo yum -y install python-pip python-devel gcc
    sudo pip install --no-cache-dir --upgrade mwscan 

you can check general access log, nginx/apache, some connections you can see there.

or

configure `auditctl` to log:

    auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

then check whats going on:

    ausearch -k mage_malware | aureport -f -i

    
    File Report
    ===============================================
    # date time file syscall success exe auid event
    ===============================================
    1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771