Thanks for your answers!
@Condobloke, no reinstall, I testet system with clamAV, rootkithunter, chkrootkit and maldetect.
Nothing found after the reboot.
I guess it was an crypto miner running or script using my server for ddos, because system was OOM when I arravied at the server physically...