The breech should be fixed now but is it possible to check for any DDoS malware installed on the server or some other malicious software? What are the recommended steps now short of reinstalling everything?

Honestly, reinstall everything.

And look into strong passwords.

You'd need to check every single file against known good files.

It would be quite the undertaking but it's posible in theory.

Maybe ClamAV and rkhunter? But I know nothing of servers..

In all honesty, they could have made so many things as a superuser that it'd probably be easier to reinstall, and most audit systems won't flag much besides "someone became root", I'd say check how attackers try to scout or exploit systems for attack, a lot of those steps apply in a very similar manner to finding how someone could have left a backdoor or such, e.g., checking systemd services, cron jobs, file permissions, setuid files, in your case also check files that were modified recently, if the kernel and secure boot weren't tampered with in any way, etc wtc.

If you do not have physical access, you can't guarantee that your check captures the true state of the server.

Yeah 100%, you need to do it directly on the machine.

Hopefully a potentially compromised machine is not allowed any network access.

The possibilities of what could have been done with a sudo password are endless, the only safe answer is back up only inert user data and wipe the rest and reinstall.

Was this done over ssh? If so you should be locking down port 22 to only certain privileged IPs via firewall, I do so in two layers, once at my router and again on the OS firewall, white-listing allowed IP addresses that I control.

Never allow ssh via PW, disable ssh as root, and allow ED25519 keys only in sshd config.

You can change the ssh port, and you can deploy fail2ban but I far prefer just denying aptempts in the first place,

Changing the port is just "security via obscurity" and is actually neither. Port 2222 is not nearly as clever as you think it is.

I'm not sure what you mean by disable root remote password login. We only access the server via ssh and then use sudo. Is that not normal?

Banning IPs based on failed attempts is a good idea. Is this something out of the box or do I need to install something to do this?

Sorry, you said "someone guessed the superuser password" on the title, which implies someone logged in as root directly, if someone with sudo privileges had their account compromised that a very similar issue still.

I think IP banning was something the fail2ban package does, not sure if it is installed or set up by default on Ubuntu server.

Aren't users with sudo rights called superusers?

For a start use ssh keys to login.

Yeah, a quick nmap or just guessing common alternative ports can catch it.