Little more complex than that. They issue a command that ends up downloading a bunch of shell scripts and goes from there. Does a lot of other nasty things too like trying to steal any ssh key on the machine to presumably use those machines to mine.

Luckily running inside of docker prevents a lot of that by default.

It is very noticeable though when you log into your dev server and the cpu is pegged at 100%.

I copied some of what it did here: https://gist.github.com/dawnerd/50915749d05d865025b447d5941f...