Hacked site and replicating files

A site that I manage was recently hacked. Though I have restored it from a good backup on a new server, I’ve retained the hacked site to find out more.

An image folder was created on the root with a single file called toggige-arrow.jpg (malware disguised as an image). The htaccess and index.php files (as well as selected files in various folders) were also injected with malware php code. These files immediately re-generated when deleted. Removing practically all files and plugins and uploading from good ones did not solve the issue. I also do not see a cron that could be responsible for this.

My question: How are these files being re-generated? What is the source trigger and where might that be located? A Google search for toggige-arrow.jpg shows many websites that have been brought down by this same type of hacking.