can anyone with linux or sandbox knownledge please check if there is malware, trojan to steal wallet.dat or script to take a part of the hash power to a specific address?
There is no way to tell this until the source is released. Given the poster said he's "preparing" the source, yet a long time later we have seen nothing, I am beginning to assume that this is a total scam, and actually all anybody's been doing is giving 2% of their fees to the developer.
He's already been threatened with legal action, so he'd better comply with the license the owner of the original software set (basically RELEASE THE SOURCE AND THERE'S NO PROBLEM). I'm sure the community could put together the beginnings a legal defence fund against him. This kind of behaviour is just unacceptable.
For all anybody here knows, this guy's found some kind of 0-day, and is pwning everybody using the miner :-/ Seriously not cool. I don't even dare run it and look at Wireshark.