ls -l on the executables (you’ll have to find them yourself) will give the last modified time.
If it’s logging to the journal, you can grep through that and find the first time it logged.
If it truely is malicious, none of those will be trustworthy, as they can be changed by a malicious actor. If you can’t work out where it’s from, wipe and start over is probably the best bet.