I feel like there should be some way to verify that logs have not been tampered with. For example, including a checksum of the file up until that point on each line. Unfortunately they could just be rewritten after the log has changed. The only real solution I can see is a dedicated logging server, giving true write-only or append-only access.

Yeah, the entire script is horrifying. It's been a long time since I've seen malware source, especially targeting *nix.

Yes, among other lines:

   system 'find / -name *.bash_history -exec rm -rf {} \;';
   system 'find / -name "log*" -exec rm -rf {} \;';
   system 'find / -name *.log -exec rm -rf {} \;';

Not very subtle.