Background; Apps can have bugs. And apps can be stale. And apps can be coded to lie, snitch, and steal. Computers are as trustworthy and trustable as the humans that wrote the code and variously arguably less than that due to bugs and latent vulnerabilities.
The methods this rkhunter tool are using have been known to generate false positives. That’s fairly common with anti-malware more generally too, and every so often some anti-malware tool will prevent a legitimate software update, or will prevent a system from booting, or crash or corrupt an environment. Some anti-malware is nearly indistinguishable from malware, with the way it ties into a system.
Verifying checksums? Download the High Sierra distro, and install it on a scratch storage device, and compare. Roll in a copy of the file from just after the macOS 10.13.6 update, and check that. (I’ll have a look at a local macOS High Sierra 10.13.6 install in a few hours, and will post up the checksum. Unless somebody posts the checksum here sooner.)
Try Malware Bytes, if you want to scan for malware.
Why that shasum diagnostic? Because the anti-malware tool you’re testing with is portable. Here, macOS apparently does things notably differently than other distros. I’ve not booted and looked at shasum in Kali Linux or another distro. The tool has not been updated to conditionalize this detection on macOS.
The degree of persistence you’re describing is not going to be addressed by rkhunter nor other OS-level detection tools, too. Not unless tose tools peek into the firmware and the hardware, and that’s not common;
Allowing root login access is something an increasing number of folks consider poor practice, and seek to discourage. Apple disables this login access by default, which is what this tool is reporting.
None of the above has bearing on the reported persistence here, either. Surviving a wipe-and-reload requires a different implementation approach from what this rkhunter tool can even detect.
Where is this all headed? Contact the folks maintaining this tool, or pay for somebody to reverse-engineer this tool and its assumptions and how this aligns with macOS and the findings of the tool, or hope that somebody will do a fair amount of detailed research into this app and into your installation and into the reported malware persistence—for free.
If you’re a likely target or on the path to a target, please get some direct and personalized help with your security. That probably won't involve rkhunter, but will probably involve current macOS Mojave, deep(er) backups, two-factor authentication, a password manager, and a variety of other and on-going details. Various resources are available. And presuming the degree of persistence being described in your postings here—surviving a wipe-and-reinstall—holds throughout, potentially with replacing or reloading or resetting everything. But I’d not start that replacement based solely on what rkhunter is reporting here.
