Unfortunately I cannot, this is way above my pay grade of amateur system administrator. I have no clue how the authorized keys file was tampered with in the first place, no idea where the executable is or whether it is currently running but hiding from ps or top because nothing looks suspicious.

I could use some help, actually, the blog post lists executable hashes but I have no idea how to check my entire system for them.