4 ms·
But why does the malware need curl in the first place? It seems perfectly capable of downloading things without. And it's running on windows where it's guarente
by poizan42 11y ago
But why does the malware need curl in the first place? It seems perfectly capable of downloading things without. And it's running on windows where it's guarenteed to have a http library available anyways.
- miahi 11y agoIt probably contains already-written scripts that invoke curl. Re-usability is a plus :).
- barkingcat 11y agomalware users often purchase exploits and scripts - it's not like they will rewrite their scripts to take advantage of http libraries or even care about efficiency. I suspect it's just part of a package that someone bought and is using.
- fla 11y agobandwidth evaluation ?
- giancarlostoro 11y agoMost antivirus software will probably account for direct Windows API usage and maybe using CURL doesn't set off such flags? Not sure, I don't make antivirus software, nor do I use it.
- rnovak 11y agoWhere in the post did it say it was running on windows? It was stated that the User Agent string wasn't identifiable, nor did it send any identifiable headers. edit: thanks for the clarification, I totally missed the file name
- cypres 11y agoIt's downloading a curl release based on mingw32, aka gnu for windows.
- bobbyi_settv 11y agoThe malware must already have a way to make http requests because it is downloading curl via http.
- staz 11y agoMaking an http request for an hardcorded path (and no https) is quite easy, you just need to open a socket and send a two lines header. curl can do more advanced and intelligent things than that.
- SixSigma 11y agoCurl is more than an http client or else wget would. Raw sockets would work just fine when you control the Web server