TrendLabs: Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners

Figure 1. Script downloading from domain, logged from one of our honeypots.

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/linux-coin-miner-copied-scripts-from-korkerds-removes-all-other-malware-and-miners/