So far all files seems to be clean and the following security plugins are not able to find anything:
Sucuri Security - Auditing, Malware Scanner and Hardening
Quttera Web Malware Scanner
Asgard Security Scanner
No idea where that script is coming from.