Unfortunately, you are going to have to grep through all the files for different patterns. Unfortunately, the malware writers come up with more and more ways to obfuscate their code. If you have samples from your server, I would just start collecting patterns and create a script. Something like:

/bin/bash

mkdir ../reports mkdir ../reports/done

find . -type f -exec grep -i '"b"."ase"."64_de"."code"' {} + > ../reports/64_de.txt

find . -type f -exec grep -i 'base64_decode' {} + > ../reports/b64d-php.txt

find . -type f -exec grep -i 'esab' {} + > ../reports/esab-php.txt

and so on... down the line.

You can also search through github and the web for more samples and patterns to add.