Monero miner scripts are downloaded from TeamTNT’s server and piped to “bash” using a SSH session on the underlying host as the “root” user by supplying the private key from “/tmp/TeamTNT.” Later, the private key “/tmp/TeamTNT” is removed as well.