Hacker News Reader

Comment by poizan42 | Hacker News Reader

But why does the malware need curl in the first place? It seems perfectly capable of downloading things without. And it's running on windows where it's guarenteed to have a http library available anyways.

View on HN

It probably contains already-written scripts that invoke curl. Re-usability is a plus :).

Most antivirus software will probably account for direct Windows API usage and maybe using CURL doesn't set off such flags? Not sure, I don't make antivirus software, nor do I use it.

malware users often purchase exploits and scripts - it's not like they will rewrite their scripts to take advantage of http libraries or even care about efficiency.

I suspect it's just part of a package that someone bought and is using.

Where in the post did it say it was running on windows? It was stated that the User Agent string wasn't identifiable, nor did it send any identifiable headers.

edit: thanks for the clarification, I totally missed the file name

It's downloading a curl release based on mingw32, aka gnu for windows.

Curl is more than an http client or else wget would. Raw sockets would work just fine when you control the Web server

The malware must already have a way to make http requests because it is downloading curl via http.

Making an http request for an hardcorded path (and no https) is quite easy, you just need to open a socket and send a two lines header. curl can do more advanced and intelligent things than that.

bandwidth evaluation ?

Reply on news.ycombinator.com