A malicious file is usually a symptom, not the cause. Before cleanup, capture the modification time, hashes, processes, connections, and any related cron jobs.
The goal is to understand, not just clean up
Once the incident is contained, check user accounts, vulnerable plugins, access keys, logs, and web server rules. Only after that can you talk about restoring trust in the system.
First steps after discovery
The first move isn't deleting the suspicious file -- it's capturing the scene: take a snapshot of the file system and database in their current, "infected" state. That sounds counterintuitive, but without that snapshot you can't investigate the incident after cleanup -- the evidence disappears along with the file.
Finding the entry point
A deleted malicious file almost always comes back if you haven't found how it got in: an outdated plugin with a known vulnerability, a compromised admin password, an unprotected file upload form, or a leftover test script. Until the entry point is closed, cleanup is just treating the symptom.
What to do so it doesn't happen again
After an incident, it's worth changing every password and access key (including any that could theoretically have been compromised), updating the CMS and modules to current versions, restricting file and folder permissions to the minimum needed, and setting up file-change monitoring so a repeat intrusion is noticed right away, not weeks later.