This looks like a particularly nasty virus. https://www.zdnet.com/article/new-linux-crypto-miner-steals-your-root-password-and-disables-your-antivirus/ -- Carmel