Site hacked, how to find the file responsable?

Hi everyone, first off I have a backup and have uploaded that to the actual websites to fix the problem. Changed passwords etc. I copied the infected files over to a spare domain to try and find the vulnerability but the coding side isnt my strong point.

I suspect it might be a contact form hack because another site I have has the exact same message, but only those 2 (of several) and thats the only common factor.

It redirects to this message even locking out the WP-ADMIN.

I have been going over files and plugins one by one and deleting to try and find the file, but taken out all the folders leaving only the core files and its still there.

Any advice? or a common exploit that does this?
All help appreciated.

Also, just copying the text into a quote, so it can come up in common searches.
Its apparent its one of those typical scam tricks with no substance, but want people to not panic if they can find the solution:

I’m own your computer owner. And all your data and some of your pictures in my computer.

If you want to delete them.

send 100$ to this bitcoin address: [ Deleted, don’t post that here ]

If you dont know how to buy bitcoin you can search on google.

If i dont received i’ll do some interesting things.(some of guys on deepweb wants to buy your home address for 10$ for illegal purposes)
This is not joke.

remember you have a 48 hours to send money.

This is not scam, if you ignore that message. You can see
hw to buy bitcoin LINK HERE

• This topic was modified 4 years, 6 months ago by raqpunzel.
• This topic was modified 4 years, 6 months ago by raqpunzel.
• This topic was modified 4 years, 5 months ago by Jan Dembowski.

The page I need help with: [log in to see the link]