Detection would wind up being an arms race, I expect; if you were going to do this, better to replace it with an application that just does the warning, with a hint for valid users blindly downloading.
Of course, then there's checking MD5s, etc.
Of course, then there's checking MD5s, etc.
Let the malware developper have fun debugging this issue.
"an updated version of the malware comes bundled with the curl library"