Certainly curl is used by lots of malware, and many a hacker probably use curl in their software.

I guess it's possible he was flagged by someone reviewing malware. Would malware creators give any credits?