On one of development machines, we've noticed high CPU usage caused by
md process. A short inspection has lead to
~/.info/md process which turned out to be monero miner, started by crontab.
Unfortunately we've deleted it too eagerly, without inspecting, how it could get there.
It could be installed 'for fun' or as a part of some performance benchmark, or anything, but if it was a worm or virus, than we have a bigger problem for inspect.
Does the installation directory and the name of the process matches any known worm or virus? It looks like an attempt to hide the activity behind under the legitimate processs name (though on *nix all 2-character names are probably reserved for something legitimate).
The machine is running Ubuntu.
I've tried googling for 'monero worm .info md' but without any reasonable results, probably the whole phrase is not good searchable.