I have now deleted the folder and all files it contained. I've also
killed all the processes.
Did you make copies of the files, or simply delete them? Because without them there's really no way to tell you anything definite about them.
You should not assume you've cleaned everything out or blocked all access to the attacker. Your best bet is to backup your data and wipe the server. If you're not ready to do that, at least walk through steps like those listed here.
Have you seen anything similar?
Google has. Just going by those results, the attack vector was probably Shellshock. Are you patched against it?
Apart from overloading the server, can you from the above information understand what the intention of this was? What can it do to our server?
No, we would need to see the contents of
/home/user/.lesshts/kthread to be able to answer that question. If I had to guess, it was probably scanning and trying to infect other people vulnerable to Shellshock, but that's just a wild guess. Again, you removed the obvious sign of compromise. How many non-obvious backdoors did they leave behind?
Updated: Based on the binary you uploaded (see comments below), the kthread program looks like the Tsunami IRC/bot. Here's a good technical analysis. Your system was probably bogged down because it was participating in a DDoS attack.
Most important: Do you have any idea how I can prevent malware from being uploaded to the server again?
Again, there's a good answer on that here. My advice, though, is:
- Build, patch, and secure a replacement system
- Migrate important and necessary data only from old to new system
- Wipe the old system
When you're migrating data, obviously, don't log in from the compromised system to the clean system - copy from the compromised system which has potentially compromised credentials instead.