Site hacked and init.php locked

Help!!! My wordpress site has been hacked somehow. I’m running 4.9.6 and all my plugins are up to date.
At the top-level WP directory (ie the level with .htaccess and index.php etc) there is a init.php file that has been modified and the security set on it so that I cannot open, copy or download it via SFTP (FileZilla). This appears to be connected with the hack. In terms of the hack, new users are being set up on my site and posts added in their names even though security is set to disable self registration and there are only two administrators with rights to set up users.
Any suggestions for how to get out of this mess?