Not just a miner, the malware also sets up a hidden default account with system administrator privileges, to be used for re-infection and further attacks.