Your system definitely has been compromised or at worst hacked. There are other stories describing a similar miner being installed.
I would take the position that your system has been compromised and get anything critical off of it to start, so that you have it backed up if it isn't already being done so.
If you're curious how they got in, you'll need to get a complete list of what services (web, mysql, etc.) you have installed and see if there are any active exploits that would allow someone to gain elevated privileges.
I would start with any web enablements which are applications that are web based. It's typically the case that these applications can be buffer overflowed and access to modifying the web server's stack so that additional applications can be installed.
It is the case that these types of compromises can be isolated incidents, so simply removing the offending software and the malware can be enough to root it out without having to endure the time expense of doing a full recovery/setup of the system.
If this system was built using a VPS based image then I'd work with the provider, since patching it would seem to be in their best interests for all their customers.
Beyond just compromising the web stack
Everything on the box has to be scrutinized and is essentially untrustworthy, but I would take a bit of time to see if you can't figure out where the attackers are logging in from, if at all. They're possibly logging in using SSH accounts that were added to the system after compromising it.
This can be an arduous task taking many days to do analysis, especially if you cannot trust any of the tools on the box to assist in this endeavor. I would encourage anyone to take this time to understand how their system got compromised so that you can reduce the risk of it happening again in the future, at least through this particular vector.
If this isn't a production type of issue, this is actually a good learning opportunity to gain valuable insight into how systems can be compromised and access can be "leveraged up" by would be attackers.
Since the system is being used for mining purposes it's likely that they used an automated scripting tool set, since attacking enough systems to setup zombie miners seems like it would take a lot of time. When tools such as these are used, they're usually shoddy in their construction, simply only looking to do the bare minimum to gain a foothold and then deliver their payload (the mining software), so you may get lucky and get some additional insights into how they were able to get in.