Someone Logged into a client WordPress site and uploaded files

A person from Romania hacked into a clients WordPress site. According to the log, they uploaded a file named cachex.zip. I found out that it was uploaded to the plugins folder, but I can’t delete it. There’s also another file called decompress.sh that I can’t delete, and I think is linked. I can’t find any info anywhere on this type of hack. Anyone have any insight?